MDM Agent on iOS

Question

I worked on MDM on Android and used the API to lock, clear, etc. when I receive a C2DM push message from the server.

When I tried to learn more about the iOS part, I was a little confused. I got the feeling that we do not need to code the agent for MDM to work on the iPhone.

So is it fully server-driven? Or do I need to have an agent application? If so, can you help me with a sample programming agent?

Thanks.

Answer 1

For full MDM management for iPhone, you need to either look at the profile management as sent from Mac OS X Lion Server (they added it to this OS version) or a third-party solution (MobileIron, Tarmac, etc.). There is also a good one background, slightly dated information: How to configure / install MDM server for iPhone and iPad

EDIT

There is no need for a separate agent application - it is processed by iOS itself.

Answer 2

If you are not using Lion Server, you can implement your own MDM server and for this you need an iOS Enterprise developer account.

To implement MDM Server, follow the instructions below.

• This pdf https://media.blackhat.com/bh-us-11/Schuetz/BH_US_11_Schuetz_InsideAppleMDM_WP.pdf is very useful.

• The server URL should start only with "https" and this url should exit, and you must provide this data when creating the mobileconfig profile using IPCU.

• You can also go to this page: http://www.softhinker.com/in-the-news/iosmdmvendorcsrsigning , and then check out a few things to remove the passphrase from customerPrivateKey.pem using this command

openssl rsa -in customerPrivateKey.pem -out PlainKey.pem

Then merge your APNS certificate (e.g. CustomerCompanyName.pem) downloaded from the https://identity.apple.com/pushcert/ portal using this command

cat CustomerCompanyName.pem PlainKey.pem > PlainCert.pem 

Now this PlainCert.pem file can be used on your server as an APNS / MDM certificate.

Answer 3

The answer is

Guys yes. I am sure most of you have had this question. Having experience after developing MDM on iOS, we do not need a client that will be encoded separately in iOS. iOS takes full care of this.

Thus, you may need a client only to specify a link to a server that has a configuration profile (so that you can actually keep a record of who and how many of them installed the application using the key or identifier in the URL), and if you need to manage things that are not provided by MDM, such as location updates, etc.