Configure Secure Email within OMSS using Oracle Mobile Secure Mail Manager (OMSMM) on iOS Device

All the set up for MS Exchange server required for this OBE to work, is the default configuration for Exchange Server
except that Authentication in IIS Manager should be set to Windows Authentication for MS ActiveSync.

ActiveSync is required for the SecureMail to work correctly. This is configured by default, when you install MS Exchange Server.

1. You can see the ActiveSync configuration in the Exchange Management Console as shown below.

   

2. Open IIS Manager on the Exchange Server windows machine. On the left panel, Navigate to <machine name> > Sites >
Default Web Site > Microsoft-Server-ActiveSync .
   On the right panel, Double-click Authentication under IIS section.

   

3. Notice that Windows Authentication is enabled. Select Windows Authentication and Click Providers
   in the right pane. It should be configured for the following providers in this particular order.

   

   

OMSS comes with a set of enterprise ready productivity apps like secure browser, file browser, and document viewer/editor that ensures corporate data is always protected.

Download Oracle Mobile Security Suite 11.1.2.3.2 from support.oracle.com using patch # 21870612 - p21870612_111232_Generic.zip.

Refer to Install the Containerization Tool section in the Securing Oracle BI Mobile HD Application using Oracle Business Intelligence Mobile Security Tool OBE to install c14n containerization tool on the Mac machine.

Core apps for Email, Calendar, Contacts, Tasks, Notes are offered as part of the Oracle Mobile Security Mail Manager that should be downloaded and licensed separately as an add-on to the Oracle Mobile Security Suite.

Note: You need a separate license for Oracle Mobile Security Mail Manager.

If you have the additional license for OMSMM, you can download it from support.oracle.com using patch # 21870622 - p21870622_330_Generic.zip

For each application that you want to have a push notification enabled, you must have an App id created for that application.

• On the Mac machine, Navigate to https://developer.apple.com. Select Certificates,Identifiers & Profiles.

  

• Click Identifiers.

  

• Register the Secure Mail app(TouchDown) under App ID. Click + on the App ID page to register a new app id.

  

• Provide a unique bundle id for the TouchDown app (you cannot use wildcard bundle id for notifications)

  

• Make sure Push Notifications is Enabled. Click Continue.

  

• Click Submit.

  

•  Click Done.

  

• Click Edit at the bottom of the iOS App IDs. Click Create Certificate Under Production SSL certificate section of the Push Notifications service for Touchdown app.

  

  
  

  

• Click Continue.

  

• You have to upload an existing CSR file on the Generate your certificate screen. To create a CSR,
  open KeyChain Access application from Applications > Utilities > KeyChain Access.

  

• From KeyChain Access menu, Select KeyChain Access > Certificate Assistant >
Request a certificate from a Certificate Authority. Enter certificate information as shown below. Click Continue.

  

• Specify name and location to save the CSR file. Click Save.

  

• Click Done.

  

• Navigate back to developer.oracle.com and upload the CSR file on Generate your certificate screen.
  Click Generate.

  

• From Your certificate is ready screen, download the certificate (aps_production.cer) on your Mac desktop.

  

• Open KeyChain Access. Select File > Import Items. Import the aps_production.cer certificate into the
  keychain access. Once the import is successful, you should be able to view the certificate and the corresponding
  private key in KeyChain Access.

  

• Finally, you will export the certificate and the corresponding key as a .p12 file and save it on your Mac desktop. You will
  use this file later.

  

• Select certificate and the corresponding private key within the KeyChain Access. Select File > Export items. On the
  Save window, specify Save as name APNSCertificate and save the .p12 file to the Desktop.

  

• When prompted, set a password to protect the certificate (Remember this password as you will need this later to set the
  APNS properties in MSAC). When prompted to enter the login keychain password, enter the password for the Mac OS
  user you are logged in as.You will use this file later.

  

You cannot use star distribution profile for push notification apps. You must have a unique enterprise distribution profile for the secure mail app.

• Under Provisioning profiles, click Distribution node. Click + to create a new provisioning
  profile. Select In-House distribution profile. Click Continue.

  

• From Select App ID, Select the touchdown app that was previously registered under Identifiers > App ID.
  Click Continue.

  

• From the Select certificates, pick one of the certificates to include with this provisioning profile. Note, this
  is an iOS distribution certificate used to sign the app (and not APNS production iOS certificate type). You have already
  created an iOS distribution certificate which you will be using as shown below: The certificate shown has already been deposited in the KeyChain Access.

• 

• Use the above certificate to include in the provisioning profile for the app.

  

• On Name this profile and generate, Provide a provisioning profile name and click Generate.

  

• From Your provisioning profile is ready, you should be able to download the provisioning profile. Click Download
  and save it on your Mac desktop.

  

You have now created a Provisioning Profile.

1. Unzip the file, p21870622_330_Generic.zip, downloaded above, and observe the containerized, but unsigned app named
   iOS-TD-bmtouchdown_c14n_3_6_2-1150_16817-unsigned.ipa.

   This is the OMSMM app that you will use to sign using your own enterprise certificate and provisioning profile.

2. Move to your Mac machine where you installed the containerization tool. Run the c14n tool to observe that this
   app has already been containerized but hasn't been signed using the following command.
   c14n -c info -i iOS-TD-bmtouchdown_c14n_3_6_2-1150_16817 -unsigned.ipa

   

3. Now you will run the command to sign this app using your enterprise certificate and provisioning profile.
   Note: The enterprise certificate must be the same as the one which was used to sign the secure workspace container. You must also change the bundle identifier for the app based on your provisioning profile.
   c14n -c signonly -i iOS-TD-bmtouchdown_c14n_3_6_2-1150_16817-unsigned.ipa -o iOS-TD-bmtouchdown_c14n_3_6_2-1150_16817-signed.ipa -id <bundle id> -cert "<enterprise_cert_name>" -p <enterprise_prov_profile_name> -v

   

   
   

   Note: Since the OMSMM has already been containerized, you do not need to run -c inject option. You simply need to
   sign the app, hence run it with -c signonly option.

4. Run the c14n command to verify that the app has been successfully signed using the following command.
   c14n -c info -i iOS-TD-bmtouchdown_c14n_3_6_2-1150_16817-signed.ipa

   

Publish the app to the catalog.

1. Login to Access console as oamadmin@idc.oracle.com/Oracle123. Navigate to Mobile Security tab > Mobile Security Manager > Mobile App Catalog.
   
   Click on Add to add OMSMM app to the catalog.

   

2. Specify the properties as shown below and click Add.
   Containerized: Yes
Name: SecureMail
Platform: iOS
Specify File: iOS-TD-bmtouchdown_c14n_3_6_2_1150_168217-signed.ipa

   

3. Navigate to Mobile Security tab > Mobile Security Manager > Mobile Security Policies option. Click on MDM MAM Policy row

   

4.  Under Apps and Configuration tab, add Secure Mail app to the policy. Select Install on Homepage option. Click Apply.

   

5. Click on Workspace tab and under Application Settings section, set the PIM to Allow and specify the Email Server URL. Set the Configuration Type to Auto. Click Apply.

   

   Click Save.

The PIM (personal information manager) app covers e-mail, calendar, contacts, and notes. It indicates personal information manager settings as follows:

• Allow: A check mark indicates that the user can access the Workspace personal information manager app.
• E-mail Server URL: Provide the e-mail server URL for the ActiveSync server as it applies to users assigned to this policy. Mobile Security Manager supports different mail servers for different user groups.
• Basic ActiveSync Authentication: Select to configure basic authentication for Microsoft Exchange ActiveSync.
• Configuration Type: Choose one of the following ActiveSync authentication options:
• Auto - The e-mail server URL is automatically retrieved from the policy and authentication to the e-mail server occurs automatically when it is enabled for one of the single sign-on mechanisms supported by the Secure Workspace app.
• Basic - The e-mail server URL is automatically retrieved from the policy but basic authentication credentials must be entered by the user during configuration of their PIM client.
• Manual - Both the e-mail server URL and basic authentication credentials must be entered by the user during configuration of their PIM client.