Android Enterprise support: Client configuration management

[jasonbayton]

I may have touched on enterprise use in the past @AndyScherzinger, but this is slightly different.

Rather than uploading a config payload into an MDM platform alongside the NC app to automatically setup the NC client on a per-user basis, Android Enterprise APIs can be used within the app to provide these configuration fields to administrators as soon as the app is uploaded.

For example, an email client:

Let's me set the user, server and even password, making deployments to endpoints so easy it's hardly even believable.

If the NC app can hook into the Android Enterprise platform I think you'd have a pretty attractive offering for businesses running 10's of hundreds (/thousands) of android endpoints.

https://developer.android.com/work/managed-configurations.html

And the beauty is, users can have NC installed for both work and personal, meaning the business controls (and can remove) the data in the NC AE installed app (identified by a small briefcase icon on the app icon) meanwhile the normally installed NC app connects to the user's own NC and can't be tampered with by the business at all.

I can both provide access to my EMM lab environment for testing and/or document the setup and deployment of the app under Android Enterprise.

[jasonbayton]

@mario could this be something for you also?

[mario]

@jasonbayton assign it to me and I can eventually take a look. :)

Glad you're willing to help!

[jasonbayton]

@mario I have a particular set of skills, but no coding experience to make any meaningful impact on this or any other project unfortunately. The environment(s) is there whenever you, Andy or anyone else want to take a look :)

[mario]

That and your willingness to test is all I need ... unless you want to bribe me with pancakes and a good wine :D

Also, you're always more than invited to try and contribute code-wise - I'd be happy to teach you basic coding skills.

[jasonbayton]

@mario I'd love to put a basic app together, perhaps we can discuss on the forum and keep this on topic.

[tobiasKaminsky]

@jasonbayton you can always join us on IRC: #nextcloud-mobile

[jasonbayton]

Bringing this back into the spotlight,

Here's an example of what I can do with Gmail:

And by contrast, Nextcloud:

(No configuration at all)

When a theoretical implementation of configuration support is complete, I should be able to:

• Input the server URL
• Input the userID (commonly in the format of $USERID$ as EMM will take the enrolled username and dynamically apply)
• Input the user password ($PASSWORD$, hashed from enrolment or prompted if not supplied to the app)

That would then essentially install, silently, on the device fully configured (or prompt for password only) and the user will be ready to begin using the app immediately.

Here's an example from a not-dissimilar setup that makes use of json in order to setup multiple repositories in one app, in this case I'm using it through webDAV:

As NC can make use of multiple accounts, this could be explored also.

However the app in question here is licensed, and obviously not Nextcloud so misses important features like autoupload.

Android Enterprise comes in 2 flavours: BYOD and Corporately owned (Device Owner mode). On BYOD a special user profile (standard Android user profiles anyone can create) is created and merged with user0, ie the first and normally only user on a device. All business applications and data are doubly encrypted into what is essentially a container integrated into the normal userspace, so work apps show up in the normal app drawer with an icon on each to suggest they're business apps. Profile support allows the interaction between work and personal spaces that can be fully controlled by the business.

Device Owner on the other hand sets the device up purely as a business device with no user space and so no profiles. Only configurations are used here.

With managed profile support for the BYOD side, we can implement full DRM to:

• Prevent screenshots
• Prevent copy/paste from inside the Android Enterprise container to outside, on the userspace
• Prevent copying/moving data from the container to the userspace, but allow from userspace to container (so you could get a file downloaded from the net into your work account, but can't put work data on an unencrypted/unprotected user-accessible area of a device).
• and more.

Profile support resource: https://developer.android.com/work/managed-profiles.html Configuration support resource: https://developer.android.com/work/managed-configurations.html My overview: https://bayton.org/docs/enterprise-mobility/android/what-is-android-enterprise-and-why-is-it-used/

Resources still available for testing, and of course I'm here for any questions you have :)

[LKLD1337]

What happened to this topic? Manageed Configuration for Nextcloud Android App is still not available. Are there any plans? Very frustrating since we want to force the user to only use one specific WebDAV-URL

[jasonbayton]

Still dead as of today AFAIK. @jospoortvliet ?