App Wrapping MDVMware Workspace ONE UEM

You can find the most up-to-date technical documentation on the VMware website at:

https://docs.vmware.com/

VMware, Inc.3401 Hillview Ave.Palo Alto, CA 94304www.vmware.com

Copyright ©

2021 VMware, Inc. All rights reserved. Copyright and trademark information.

App Wrapping MD

VMware, Inc. 2

Contents

1 VMware AirWatch App Wrapping 5Wrapping Process in On-Premises Environments 5

File Storage 6

The Storage of Data 6

Disabling Logging in Wrapping Profiles 6

Location Data, Analytics, and Telecom Data 7

Cluster Session Management in iOS and Reduced Flip Behavior for SSO with App Wrapping v5.4or later 7

SSO Sessions and SDK-Integrated Apps 7

2 App Wrapping Requirements 8General Requirements 8

Supported Platforms and Bit Versions 8

Supported Deployments and Requirements 8

Store Apps Do Not Wrap 9

Standard Processes 9

Standard and C/C++ Libraries 9

Tampering Protection 9

Supported Settings and Policies Options 9

Visual Studio Enterprise Edition 11

Android Requirements 11

Supported Android Components 11

Android Apps Built with Crosswalk Project Libraries Do Not Wrap 11

Android Enterprise Support 11

Xamarin Requirements for Android 11

Android Bit Architecture Native Files 12

Android Method Limits and Multidex Support 12

Android Apps and the Version of the SDK That Wraps Them 13

Native Libraries in Android Apps 13

Android Library Dependencies 13

Enabling and Disabling Encryption for Android Wrapped Apps 14

iOS Requirements 14

iOS App Wrapping Requirements 14

Using iOS Apps Developed in Swift 15

Entitlements for iOS Apps 15

Mobile Provisioning Profile for iOS Apps 15

Synchronous Calls and iOS Apps 15

Integrated Authentication Code Requirements for iOS (Swift) Apps 15

VMware, Inc. 3

No Support for UIWindowSceneDelegate in iOS Apps 15

3 How Do You Wrap and Re-Wrap Applications with the AirWatch App WrappingEngine 16Step One: Turn on AirWatch App Wrapping 16

Step Two: Turn On Cloud Services 16

Step Three: Configure an App Wrapping Profile 17

Step Four: Deploy Your App 17

Step Five: Use Send Logs (iOS Only) as an Application Configuration 17

Step Six: Rewrapping 18

4 Troubleshooting AirWatch App Wrapping 19General Troubleshooting Steps 19

Send Logs for iOS (Swift) Apps 19

Troubleshooting No Static Method Error 20

Requesting App Wrapping Logs 20

App Tunnel and Per-App VPN as a Wrapping Alternative 20

Per App Tunnel and VMware Tunnel Component Explanations and Configurations 20

Additional Details for Per App Tunnel and VMware Tunnel 21

5 Known Issues for App Wrapping 22Known Issue – Browsing Web Sites and Accessing HTTP Endpoints, iOS 22

Known Issue – DAR, Data at Rest, Encryption 23

Known Issue – Incorrect Parameter Error for iOS Applications 23

Known Issue – Wrapped App Run Failure 24

Known Issue – Issues Wrapping With Apple iOS 8 24

6 Developer Resources 26Supported Developer Resources - iOS Wrapped Apps 26

Supported Developer Resources -Android Wrapped Apps 27

Mobile App Development Platform, MADP Support 28

App Wrapping and Tunnel Support for iOS APIs 29

App Wrapping MD

VMware, Inc. 4

VMware AirWatch App Wrapping 1AirWatch App Wrapping, allows organizations to secure enterprise applications with little codechanges.

App wrapping can add an extra layer of security and data loss prevention while offering aconsistent user experience. Consistency comes from using Workspace ONE UEM options such asbranding, single sign on SSO, and authentication.

Modifying your internal applications with app wrapping lets you access tools already availablewith Workspace ONE UEM by adding a layer of features over the application. Once the advancedfeatures are applied, deploy the application to your enterprise app catalog for end-users toaccess.

This chapter includes the following topics:

n Wrapping Process in On-Premises Environments

n File Storage

n The Storage of Data

n Disabling Logging in Wrapping Profiles

n Location Data, Analytics, and Telecom Data

n Cluster Session Management in iOS and Reduced Flip Behavior for SSO with App Wrappingv5.4 or later

n SSO Sessions and SDK-Integrated Apps

Wrapping Process in On-Premises Environments

The SaaS-based app wrapping engine communicates with your Workspace ONE UEM on-premises environment in the background to wrap your apps.

Workspace ONE UEM wraps and stores modified applications within the SaaS infrastructure, andit does not keep any unmodified application files. The system securely stores and deletes internalapplication files and auxiliary files. All communication on port 443 is encrypted with AES-256,over SSL, and requiring HMAC token authentications.

VMware, Inc. 5

Component Action

Administrator Uploads the internal application and ancillary files, like provisioning profiles and signingcertificates, to the Workspace ONE UEM console and initiates wrapping.

Console Notifies the wrapping engine that it has a file. The console populates the download URL for theinternal application file and ancillary files.

Wrapping Engine Goes to the URL on the internal network device services server and retrieves the files. Unzips thefiles. Injects SDK functionality. Code-signs the application and recompresses the files. Sends thedownload URL of the wrapped application to the internal network device services server.

Device ServicesServer

Downloads the wrapped application. Stores the wrapped application in the Workspace ONEUEM database, along with auxiliary files.

Wrapping Engine Securely deletes original application files, provisioning profiles, and signing certificates,depending on the scheduler task.

File Storage

The app wrapping process deletes application binary files, provisioning profiles, and signingcertificates from the app wrapping service when it completes wrapping. The system stores thesefiles in the Workspace ONE UEM database.

When adding a version of the application, the code signing files automatically populate and youcan change them if needed. However, the app wrapping service does not store the files yousupply.

The app wrapping service uses the application binary, signing certificate, and provisioning profiletemporarily to sign the wrapped application. After wrapping is complete, the system removes thefiles from the wrapping service and stores them securely in the Workspace ONE UEM database.If the wrapping fails or times out, the system automatically removes files from the wrappingservice and stores them in the Workspace ONE UEM database.

The Storage of Data

The AirWatch App Wrapping system can log data about the wrapped application, but it does notstore location data, analytics, or telecom data.

Disabling Logging in Wrapping Profiles

To deploy a wrapped application, you assign it a profile. You can enable the logging payload andconfigure the logging level in that profile. When you apply the profile to the wrapped application,the system creates an application log.

If you do not want the console to log data about the application, ensure that this feature isdisabled. Find the setting in these places:

n In the default VMware Workspace ONE SDK settings in Settings and Policies

n In a custom VMware Workspace ONE SDK profile

App Wrapping MD

VMware, Inc. 6

Location Data, Analytics, and Telecom Data

The AirWatch App Wrapping system does not track location, analytics, or telecom data.Although, other sections of the console do if you configure the settings.

n The Workspace ONE Intelligent Hub tracks location data.

n The Workspace ONE SDK records analytics.

n The Telecom dashboard reports telecom data for devices.

Disable these features if you do not want to track this data.

Cluster Session Management in iOS and Reduced FlipBehavior for SSO with App Wrapping v5.4 or later

Causes of Flipping

iOS applications wrapped with the following components are in the same keychain group, alsocalled a cluster.

n Apps wrapped with signing certificates from the same developer account

n Apps that share the same AppIdentifierPrefix

These applications can share session data like an app passcode and an SSO session. By sharingthis session data, they do not have to flip to the Workspace ONE Intelligent Hub or to the anchorapplication every time authentication is required.

Applications wrapped with the listed components are in different keychain groups, or clusters.

n Apps wrapped with signing certificates from different developer accounts

n Apps that have a different AppIdentifierPrefix

These applications cannot take advantage of passcode sharing. These scenarios require flippingto the Workspace ONE Intelligent Hubor the anchor application to obtain data like the serverURL. This flipping action occurs once per cluster.

Reduced Flipping

On iOS application wrapped with app wrapping engine v5.4+, only the first wrapped app flips tothe anchor application on the first launch. It flips to retrieve environment information. It does notflip to retrieve account data or to lock and unlock operations. In older versions of the wrappingengine, applications had to flip to the anchor application to retrieve data and to lock and tounlock operations.

SSO Sessions and SDK-Integrated Apps

The SSO session is a time frame created at the time of SDK unlock. During this time frame theapplication can access allowed network resources. If you enable SSO, all SDK-integratedapplications are unlocked and able to share keychain information between them.

App Wrapping MD

VMware, Inc. 7

App Wrapping Requirements 2View the supported platforms, bit versions, architectures, console versions, and environments forwrapping apps. Use supported systems to ensure that the solution integrates with your mobiledeployment. These requirements also list what app wrapping scenarios and components are notsupported so review for caveats.

This chapter includes the following topics:

n General Requirements

n Android Requirements

n iOS Requirements

General Requirements

Supported Platforms and Bit Versions

The application that you wrap must be compatible with the following components. If anapplication was built with an Workspace ONE SDK older than the version listed, it is notcompatible with app wrapping.

Platform Bit Versions and ArchitecturesSupported Workspace ONE UEMConsole Version

Android v5.0 or later 32-bit 64-bit Note: With the support of 64-bitarchitectures, expect a size increase of your wrappedAndroid apps when compared to previous app wrappingreleases.

Workspace ONE UEM console v1910or later

iOS v11.0 or later ARM64 Workspace ONE UEM console v1910or later

Supported Deployments and Requirements

App wrapping is available for the following deployments, using the SaaS-Hosted app wrappingengine to wrap internal applications. The feature does not wrap public or purchased applications.

VMware, Inc. 8

Deployment App Wrapping Engine App Type

SaaS Workspace ONE UEM SaaS-Hosted App Wrapping Engine Internal Applications

On-premises Workspace ONE UEM SaaS-Hosted App Wrapping Engine Internal Applications

Store Apps Do Not Wrap

You cannot wrap applications from app stores, even if the APK or IPA comes from the vendordirectly. Contact vendors to see if they can incorporate the Workspace ONE SDK and AppConfiginto their applications to address enterprise requirements.

Standard Processes

App wrapping works with Android and iOS applications developed using standard Android andiOS SDK processes.

Standard and C/C++ Libraries

AirWatch App Wrapping works with applications using standard Android and iOS Java/Objective-C layer libraries. If an application uses low-level C/C++ libraries, then some appwrapping features might not work or the application might not wrap properly.

Tampering Protection

Remove tampering protection from the application you want to wrap. AirWatch App Wrappinginvolves altering the application so app wrapping cannot work with this protection enabled.

Supported Settings and Policies Options

Assign an App Wrapping Profile to apply Workspace ONE SDK funtionality to a wrappedapplication. Configure the profile in Groups & Settings > All Settings > Apps > Settings andPolicies > Profiles > Add Profile > App Wrapping Profile.

The table lists the default settings supported by AirWatch App Wrapping. For information aboutsupported features for Workspace ONE UEM applications, see the content for that application.

SDK Default Payload App Wrapping for Android App Wrapping for iOS

Force Token For App Authentication Supported App wrapping supportsthis setting only when you enableSSO.

Not Supported

Passcode: Authentication Timeout Supported Supported

Passcode: Maximum Number of Failed Attempts Supported Supported

Passcode: Passcode Mode Numeric Supported Supported

Passcode: Passcode Mode Alphanumeric Supported Supported

Passcode: Allow Simple Value Supported Supported

Passcode: Minimum Passcode Length Supported Supported

App Wrapping MD

VMware, Inc. 9

SDK Default Payload App Wrapping for Android App Wrapping for iOS

Passcode: Minimum Number Complex Characters Supported Supported

Passcode: Maximum Passcode Age Supported Supported

Passcode: Passcode History Supported Supported

Passcode: Biometric Mode Supported Supported

Username and Password: Authentication Timeout Supported Supported

Username and Password: Maximum Number ofFailed Attempts

Supported Supported

Single Sign On Supported Supported

Integrated Authentication: Enable Kerberos Not Supported Not Supported

Integrated Authentication: Use EnrollmentCredentials

Supported App wrapping supportsthis setting only on Android appsthat use Webview.

Supported

Integrated Authentication: Use Certificate Supported Supported

Offline Access Supported Supported

Compromised Detection Supported Supported

AirWatch App Tunnel: Mode Supported Supported

AirWatch App Tunnel: URLs (Domains) Supported Supported

Geofencing: Area Not Supported Not Supported

DLP: Bluetooth Not Supported Not Supported

DLP: Camera Supported App wrapping supportsthis setting on Android only usingintents and not by hardware APIcalls.

Supported

DLP: Composing Email Supported Supported

DLP: Copy and Paste Out Supported Supported

DLP: Copy and Paste Into Supported Supported

DLP: Data Backup Not Supported Not Supported

DLP: Location Services Supported Supported

DLP: Printing Supported Supported

DLP: Screenshot Supported Not Supported

DLP: Third Party Keyboards Not Supported Not Supported

DLP: Watermark Not Supported Not Supported

DLP: Limit Documents to Open Only in ApprovedApplications

Supported Supported

NAC: Cellular Connection Not Supported Supported

NAC: Wi-Fi Connection Not Supported Not Supported

Branding Supported App wrapping onlysupports branding the loading bar.

Supported

App Wrapping MD

VMware, Inc. 10

SDK Default Payload App Wrapping for Android App Wrapping for iOS

Logging Supported App wrapping supportsonly SDK logs.

Supported App wrappingsupports only SDK logs.

Analytics Not Supported Not Supported

SDK App Compliance > Application Version Not Supported Not Supported

SDK App Compliance > Application Inactivity Not Supported Not Supported

SDK App Compliance > OS Version Not Supported Not Supported

SDK App Compliance > Security Patch Date Not Supported Not Supported

Visual Studio Enterprise Edition

To package applications for installation, use Visual Studio Enterprise Edition. You must select toEnable Bundle Assemblies into Native Code or the app wrapping engine cannot wrap theapplication.

Android Requirements

Supported Android Componentsn Build the app with the Android API level 21 or later. Older versions of the Android API do not

build applications that are compatible with app wrapping.

n Use the Android GMS library v16.0.0 for Google Play Services because it is the onlysupported version.

n Use SQLCipher for Android 4.2 or later.

Android Apps Built with Crosswalk Project Libraries Do Not Wrap

Crosswalk on Android provides a packaging tool and a Java wrapper layer. They can bundleWeb applications into the Android Web app APKs. This Java wrapper layer calls Crosswalkruntime, and Crosswalk runtime is a full-featured Web engine mostly written in C/C++. Androidplatforms do not package C/C++ code into SMALI files, and the app wrapping solution cannotmodify and wrap the C/C++ libraries and code.

Android Enterprise Supportn We support app wrapping in Android Enterprise Work Managed (Device Owner) mode.

n We do not support app wrapping for Android Enterprise Work Profile (Profile Owner) modebecause of internal app constraints. Our app wrapping engine uses internal apps, and wecannot directly publish these apps in Managed Google Play in a Work Profile.

Xamarin Requirements for Android

Workspace ONE UEM is certified to wrap applications built using Xamarin, but you must overrideall methods by the super class.

App Wrapping MD

VMware, Inc. 11

To override method() from the super class, call super.method() in the method(). This processrequires the addition of code to all applicable classes. You must also use Visual Studio EnterpriseEdition to package the application.

Code to Add

```

@Override

Public void onCreate(Bundle param ){

Super.onCreate(param); // make sure you have this call in order for App Wrapping to be

supported with Xamarin apps

}

```

Add code to all classes extending to the listed classes.

n Application.class

n Activity.class

n AppCompatActivity.clas,

n AccountAuthenticatorActivity.class

n ExpandableListActivity.class

n FragmentActivity.class

n ListActivity.class

n NativeActivity.class

n LauncherActivity.class

n PreferenceActivity.class

n Webview.class

n WebviewClient.class

Android Bit Architecture Native Files

The VMware Workspace ONE SDK and app wrapping do not support 64-bit architecture nativefiles for Android. These files, when wrapped, do not run and display no screens.

Android Method Limits and Multidex Support

The compiler that app wrapping uses has a limit of 62 thousand methods for applications. Withthe support of multidex, you can now create larger APKs with each DEX limited to 65 thousandmethods. However, app wrapping must inject functionality into the application by addingmethods to the primary DEX. To ensure that wrapping completes, ensure that the primary DEXhas 58 thousand methods or less. This method count gives the wrapping system room to injectmethods into the primary DEX.

App Wrapping MD

VMware, Inc. 12

Find information on how to limit methods on the Web from the listed site as of November 2018,https://developer.android.com/studio/build/shrink-code.html.

Example: Method Limiting in the Gradle File

```

afterEvaluate {

tasks.matching {

it.name.startsWith('dex')

}.each { dx ->

if (dx.additionalParameters == null) {

dx.additionalParameters = []

}

dx.additionalParameters += "--set-max-idx-number=58000"

}

}

```

Android Apps and the Version of the SDK That Wraps Them

The version of the Workspace ONE SDK the system wraps your app with depends on whetheryour app uses AndroidX or an older support library. If you want the latest Workspace ONE UEMfeatures, the app must use AndroidX.

n AndroidX - The app wrapping engine wraps the app with the latest version of the WorkspaceONE SDK.

n Older support library - The app wrapping engine wraps the app with the Workspace ONESDK for Android v19.7.

Native Libraries in Android Apps

AirWatch App Wrapping cannot fully support native libraries inside Android applications becausethe wrapping engine cannot interpret the processes these libraries invoke. Applications mightwrap but these applications might not behave as expected after you install them on devices.Problems can arise with core functionalities, wrapping restrictions, tunneling, encryption, singlesign-on, and other application processes.

Android Library Dependencies

Ensure that the listed libraries are not obfuscated in the original version of the application orwrapping fails.

n com.google.gson:gson:2.4

n com.google.guava:guava:20.0

n com.google.zxing:zxing:3.2.1

n com.sqlcipher:3.5.9

n com.squareup.okhttp3:okhttp:3.14.2

App Wrapping MD

VMware, Inc. 13

n libcrypto.1.0.2.so

n libencjni.so

n libf5apptun.so

n libfips_main.so

n libiocipher.so

n libkerberosapp.so

n libsqlcipher.so

n libssl.1.0.2.so

n org.apache.commons:codec:1.7

n org.apache.commons:io:2.4

n org.apache.commons:codec:1.7

n org.apache.commons:io:2.4"

n org.apache.commons:lang3:3.1

Enabling and Disabling Encryption for Android Wrapped Apps

If you want to use encryption in wrapped Android apps, ensure that no data is read unless youprogrammatically wrote it to be read. This caveat includes database and file systems.

For those wrapped Android apps that do not use encryption, ensure to disable encryption in theWorkspace ONE UEM console. If you do not disable encryption in the console, the wrapped appsmight crash.

iOS Requirements

iOS App Wrapping Requirementsn App wrapping supports wrapping iOS apps built with Xcode 10 or later.

n If @executable_path/Frameworks is missing from the Xcode build settings inLD_RUNPATH_SEARCH_PATHS of the build target, add it to Xcode build settings. If you donot add this and you are using the most current wrapping engine, the app crashes afterwrapping.

n If your iOS app is Swift based, use Swift 5.0 or later.

n iOS Developer Enterprise Account - Use this account to get Xcode used to compile theapplication as part of the wrapping process. Go to https://developer.apple.com/xcode/ forinformation. Use this account type to develop iOS applications for use internally and not todeploy to an app store. To develop internal applications, ensure to get auxiliary files forenterprise (internal) distribution and not app store deployment.

App Wrapping MD

VMware, Inc. 14

n Mobile Provisioning Profile - Get this file from Apple's Developer Portal. Get this profile forenterprise use, because it is specific to your application and to the Code Signing Certificate.The bundle ID of the provisioning profile matches the bundle ID of the IPA file.

n Code Signing Certificate - Get this file from Apple's Developer Portal. Get this file forenterprise use and not app store distribution, and use it to sign the wrapped application.

n Sign the iOS Binary - Sign the application with the provisioning profile and the signingcertificate before wrapping the application.

Using iOS Apps Developed in Swift

If your iOS app is Swift based, use Swift 5.0 or later.

Entitlements for iOS Apps

Enable the keychain-access-group's permission in the entitlements of iOS applications beforewrapping. This permission allows Workspace ONE UEM to store Secure Channel Certificates inthe iOS keychain of the application because Workspace ONE UEM uses Secure ChannelCertificates to communicate.

If you do not enable this permission, Workspace ONE UEM automatically enables the permission.If your mobile provisioning profile does not have the keychain-access-group listed in theentitlements, you might have a wrapping issue . The wrapped application might not behave asexpected when installed on devices.

Mobile Provisioning Profile for iOS Apps

Ensure you use a mobile provisioning profile that matches the bundle ID of the application.Wildcard provisioning profiles might not allow the use of certain entitlements, like iCloud.

Synchronous Calls and iOS Apps

Avoid synchronous calls, if possible. Instead, consider using asynchronous methods or puttingsynchronous calls in their own threads. Synchronous logic can negatively impact the ability of thefeature to intercept preventable calls.

Integrated Authentication Code Requirements for iOS (Swift) Apps

For integrated authentication to work for apps that use the URLSession class, use thesharedSession API to create the session.

No Support for UIWindowSceneDelegate in iOS Apps

App wrapping does not support wrapping iOS apps that use Windows Scenes(UIWindowSceneDelegate).

App Wrapping MD

VMware, Inc. 15

How Do You Wrap and Re-WrapApplications with the AirWatchApp Wrapping Engine

3The AirWatch App Wrapping engine adds Workspace ONE SDK functionality to wrapped appswhen you deploy them with the Workspace ONE UEM console.

This chapter includes the following topics:

n Step One: Turn on AirWatch App Wrapping

n Step Two: Turn On Cloud Services

n Step Three: Configure an App Wrapping Profile

n Step Four: Deploy Your App

n Step Five: Use Send Logs (iOS Only) as an Application Configuration

n Step Six: Rewrapping

Step One: Turn on AirWatch App Wrapping

SaaS deployments do not configure this option because it is already configured.

The AirWatch App Wrapping engine communicates with your network server in your on-premises environment to deploy Workspace ONE SDK functionality to wrapped apps.

1 In the Workspace ONE UEM console, navigate to Groups & Settings > All Settings > System> Advanced > Site URLs.

2 Select Enable App Wrapping in the app wrapping section.

3 Complete the entry for your platform.

n iOS App Wrapping Service URL – Enter the URL for the Workspace ONE UEM SaaS-Hosted App Wrapping Server for iOS, https://appwrap04.awmdm.com.

n Android App Wrapping Service URL – Enter the URL for theWorkspace ONE UEM SaaS-Hosted App Wrapping Server for Android, https://appwrapandroid.awmdm.com.

Step Two: Turn On Cloud Services

Turn on Cloud Services for increased security for app wrapping communications with the use ofHMAC authentication.

VMware, Inc. 16

Disable Cloud Services to troubleshoot app wrapping issues, but this action reduces securitybecause it bypasses HMAC authentication.

1 In the Workspace ONE UEM console, navigate to Groups & Settings > All Settings > Admin >Cloud Services.

2 Select App Wrapping Secure Communication Enabled. If the application fails to wrap, youcan disable the check box and try to wrap again. However, clearing the check box bypassesthe HMAC token authentication check, making this option less secure. Check the AutoDiscovery AirWatch Id entry in the AirWatch ID section (on the same page as the CloudServices section). This ID is your Workspace ONE UEM credentials and provides a secureconnection with the Workspace ONE UEM Cloud.

Step Three: Configure an App Wrapping Profile

Configure a profile to add Workspace ONE UEM functionality to your app with the WorkspaceONE SDK framework.

1 In the Workspace ONE UEM console, navigate to Groups & Settings > All Settings > Apps >Settings and Policies > Profiles.

2 Select Add Profile and choose App Wrapping Profile and the applicable platform.

3 Configure General settings and then complete the settings for the desired features(payloads). You select this profile on the App Wrapping tab when you upload and deploy theapp.

Step Four: Deploy Your App

Select the applicable organization group and upload your app and assign the correct profile towrap it.

1 In the Workspace ONE UEM console, go to Apps & Books > Native > Internal > AddApplication to add your app to the console.

2 On the App Wrapping tab, select Enable App Wrapping.

3 For App Wrapping Profile, select the AirWatch App Wrapping profile you created earlier.

4 Select Save & Assign to move to the app assignment process.

Step Five: Use Send Logs (iOS Only) as an ApplicationConfiguration

For iOS (Swift) apps, use Send Logs from within the app. You must configure the Restrictionsand Application Configuration tabs in the Assginment wizard.

1 In the Workspace ONE UEM console, add an assignment or edit one for the app.

App Wrapping MD

VMware, Inc. 17

2 On the Application Configuration tab, comple the following entries.

n Managed Access - Enable

n Send Configuration > Add

n Configuration Key - EnableSendLogsOnFatalError

n Value Type - Boolean

n Configuration Value - True

3 Deploy the assignment to devices in the selected organization group.

Step Six: Rewrapping

Applications require re-wrapping for several reasons that include app wrapping engine updates,operating system changes, and system fixes. The console identifies wrapping issues in theconsole so you know to re-wrap an application.

1 Build a new version of the app so that it has a version number that is greater than thecurrently deployed version in Workspace ONE UEM.

2 Upload the rebuilt app to Workspace ONE UEM in Apps & Books > Applications > Native >Internal.

3 Use the app wrapping tab to re-wrap the application.

Workspace ONE UEM does not push a wrapped app to devices until the wrapping engine reportswrapping success. Find the success status in the Workspace ONE UEM console at Apps & Books> Applications > Native > Internal and view the Wrap Status column.

If wrapping fails, use the Queue App For Wrapping check box on the App Wrapping tab, whichonly displays upon failure. The wrapping engine re-wraps the application after you select Save &Publish from the flexible deployment page. When the wrapping engine reports success,Workspace ONE UEM pushes the application to devices. This work flow prevents pushing failedwrapped applications to devices.

App Wrapping MD

VMware, Inc. 18

Troubleshooting AirWatch AppWrapping 4If you have problems wrapping an application or if a wrapped app fails, try troubleshooting stepsto find and fix the issue.

This chapter includes the following topics:

n General Troubleshooting Steps

n Send Logs for iOS (Swift) Apps

n Troubleshooting No Static Method Error

n Requesting App Wrapping Logs

n App Tunnel and Per-App VPN as a Wrapping Alternative

n Per App Tunnel and VMware Tunnel Component Explanations and Configurations

n Additional Details for Per App Tunnel and VMware Tunnel

General Troubleshooting Steps

Try the following steps.

n Remove Workspace ONE UEM from the process.

n Check the communication with VMware Workspace ONE Tunnel.

n Review app wrapping logs

Send Logs for iOS (Swift) Apps

iOS (Swift) app users can select Send Logs from the wrapped app. This setting can send logsafter a fatal error occurs in the initialization of the Workspace ONE SDK. To use this feature,ensure to configure two settings in the assignment in the Workspace ONE UEM console.

n Add the key-value pair EnableSendLogsOnFatalError as a Boolean set to True.

n Enable Managed Access.

VMware, Inc. 19

Troubleshooting No Static Method Error

If a wrapped Android application fails on the device, check ADB device logs for a No StaticMethod error message.

java.lang.NoSuchMethodError: No static method

addAccessibilityStateChangeListener in class

Landroid/support/v4/view/accessibility/AccessibilityManagerCompat;

This error displays when a developer built the original application with a dependency or librarynot supported by the app wrapping system.

The app wrapping system can wrap applications built with non-supported dependencies andlibraries but those applications fail on devices.

Requesting App Wrapping Logs

Request logs for your wrapped applications in the console and the system writes an applicationlog. Another type of log for wrapped apps is the crash log. The system automatically writes thisdata when the wrapped application crashes.

1 Navigate to Devices > List View and select the device.

2 Select the Apps tab and choose Request Logs. The Request Logs button displays after youselect the application.

3 Navigate to Apps & Books > Applications > Logging > App Logs.

4 Find the log for the application with the App Name column and download the file.

App Tunnel and Per-App VPN as a Wrapping Alternative

An alternative solution to app wrapping is to use the App Tunnel and Per-App VPN. Thisalternative does not require the maintenance associated with re-wrapping applications after awrapping engine update. It works as an alternative if you only want the application to tunnel intothe internal network to access resources. If you do not need advanced management features forthe application, then consider using tunneling and per-app VPN.

Per App Tunnel and VMware Tunnel ComponentExplanations and Configurations

The Per App Tunnel component and VMware Tunnel apps for iOS, Android, Windows Desktop,and macOS allow both internal and public applications to access corporate resources that residein your secure internal network. They allow this functionality using per app tunneling capabilities.Per app tunneling lets certain applications access internal resources on an app-by-app basis. Thisrestriction means that you can enable some apps to access internal resources while you leaveothers unable to communicate with your back-end systems.

App Wrapping MD

VMware, Inc. 20

This alternative solution is different from app tunneling with app wrapping because it supportsboth TCP and HTTP(S) traffic. It works for both public and internally developed apps. However,for internal apps, the VMware Tunnel app acts as an alternative option only if the solerequirement is tunneling into the internal network. Otherwise, you must use app wrapping to takeadvantage of features including integrated authentication, geofencing, offline access control, andso on.

After configuring and installing VMware Tunnel with the Per-App Tunnel component, theworkflow to enable and use per app tunneling in Workspace ONE UEM includes:

1 Creating a VPN profile for your end-user devices. These profiles depend on your deviceplatform.

If your platform uses user profiles and device profiles, such as Windows Desktop andAndroid, you must create user profiles.

2 After creating a VPN profile, push the profiles and the apps to the devices.

For iOS and Android platforms, you must enable the Use VPN check box on the Deploymenttab of the Add Application page to use app tunneling.

Windows Desktop devices use the native Per-App VPN functionality. Add the apps to the VPNprofile to enable Per-App Tunnel functionality.

Note: VMware Tunnel does not support Per-App VPN functionality for macOS devices. You canrestrict access to domains through the Safari Domains feature of the Network Traffic rules.

Additional Details for Per App Tunnel and VMware Tunnel

An on-demand feature lets you configure apps to connect automatically using VMware Tunnelwhen launched. The connection remains active until a time-out period of receiving no traffic, thenit is disconnected. When using VMware Tunnel, no IP address is assigned to the device, so youdo not need to configure the network or assign a subnet to connected devices.

In addition, iOS apps can use the iOS DNS Service to send DNS queries through the VMwareTunnel server to the DNS server on a corporate network. This service allows applications such asWeb browsers to use your corporate DNS server to look up the IP address of your internal Webservers.

App Wrapping MD

VMware, Inc. 21

Known Issues for App Wrapping 5App wrapping has known issues, some with workarounds and some without. If you are havingdifficulty with your wrapped app, see if there is a known issue with a suggested work around.

This chapter includes the following topics:

n Known Issue – Browsing Web Sites and Accessing HTTP Endpoints, iOS

n Known Issue – DAR, Data at Rest, Encryption

n Known Issue – Incorrect Parameter Error for iOS Applications

n Known Issue – Wrapped App Run Failure

n Known Issue – Issues Wrapping With Apple iOS 8

Known Issue – Browsing Web Sites and Accessing HTTPEndpoints, iOS

Browsing Web sites and accessing HTTP endpoints is slow when you use the VMware Tunnel.This behavior occurs only on iOS.

n Explanation

When accessing a Web site or an HTTP/S endpoint using the VMware Tunnel, every requestis signed for VMware Tunnel validation. This signing can add significant overhead for Websites that have many requests.

A Web page that contains many resources (images, css, and javascript files) exhibits delaysbecause each resource that is downloaded is signed. For example, a page with 50 imagesand many javascript files sees delays much greater than a Web page with only 5 resources.

Workspace ONE UEM is developing new VMware Tunnel functionality to resolve thisarchitectural issue.

Note: The known issue does not affect Android.

n Workaround

The app wrapping version deployed with Workspace ONE UEM improves the performance ofbrowsing in Web sites using HTTPS.

VMware, Inc. 22

The latest app wrapping version does not improve the slow behavior with Web sites that useHTTP.

Consider creating a self-signed SSL certificate for the Web site or endpoint and test thebrowsing speed with the new app wrapping implementation.

Known Issue – DAR, Data at Rest, Encryption

Workspace ONE UEM and the app wrapping feature does not support DAR encryption for theapp wrapping engine for iOS. However, it does support DAR encryption for the app wrappingengine for Android. Workspace ONE UEM uses the Advanced Encryption Standard, AES-256,with encrypted keys for encryption and decryption.

n Explanation, Android

When you enable DAR in app wrapping, the app wrapping engine injects an alternative filesystem into the application. It securely stores all the data in the application. The applicationuses the alternative file system to store all files in an encrypted storage section instead ofstoring files in disk.

DAR encryption helps protect data in case the device is compromised because the encryptedfiles created during the lifetime of the application are difficult to access by an attacker. Thisprotection applies to any local SQLite database, because all local data is encrypted in aseparate storage system.

n Explanation, iOS

Although Workspace ONE UEM and the app wrapping feature do not currently support DARfor iOS, review the following information on data protection when developing iOSapplications.

iOS 7 includes data protection for all third-party applications. This data protection requires noaction by a developer to enable the DAR encryption. However, it requires the device user toset a passcode.

The data protection level that is enabled by default is the same as the Complete until firstlogin mode. The local files are encrypted from the time the device restarts to the time theend-user unlocks the device.

Known Issue – Incorrect Parameter Error for iOSApplications

Save Failed error displays after uploading a wrapped iOS application to the Workspace ONE UEMconsole.

n Explanation

When uploading iOS applications to Workspace ONE UEM, you also upload thecorresponding certificates and provisioning profile. A corrupted certificate can cause thefollowing error when wrapping an iOS application in Workspace ONE UEM.

App Wrapping MD

VMware, Inc. 23

n Workaround

Check the validity of the certificate using these processes.

n Validate the bundle ID of the application to the corresponding certificate and provisioningprofile.

n Validate the certificate on a Mac device by double-clicking the certificate file and adding itto the Keychain. If the certificate fails to add to the Keychain, the certificate does notwork.

n Validate the certificate on Windows by double-selecting the certificate to import it to thelocal machine. If the import wizard displays an error at any time, the certificate does notwork.

n Validate that the certificate has the P12 file extension. If it does not, the certificate doesnot work.

Known Issue – Wrapped App Run Failure

Wrapped apps loop continuously when starting from the Workspace ONE Intelligent Hub or theContainer application.

n Explanation

A possible cause for the loop is a setting in the wrapped app that forces the application toclose when you send it to the background.

n Workaround

Check the PLIST file for the setting UIApplicationExitsOnSuspend. If this option is enabled,remove the setting a rewrap the application.

Known Issue – Issues Wrapping With Apple iOS 8

Applications are not wrapping successfully or are not loading on to devices running Apple iOS 8after wrapping.

n Explanation – Compatibility

Applications developed to run on Apple iOS 8 are not functioning as expected whentunneling through VMware Tunnel or using other application settings and policies.

n Workaround – Compatibility

Validate the date the app was wrapped and the app wrapping engine version to ensure thatthe engine was compatible with the iOS version. If the wrapping date or engine version isdifferent than what is listed, rewrap the application.

App Wrapping MD

VMware, Inc. 24

Find this information on the Wrapping tab by navigating to Apps & Books > Applications >Native > Internal. Select Edit from the actions menu of the wrapped app to view theWrapping tab.

n Use the Wrapped Engine version 3.2.1 or later. If the engine version was before 3.2.1, theolder engine version might have caused an issue with wrapping.

n Check that the date the app was wrapped is after September 15, 2014. If it was beforethis date, the app wrapping engine was not compatible with Apple iOS 8 at the time.

n Explanation – Code Signing Signature

Applications developed to run on Apple iOS 8 are not functioning as expected. Theapplication cannot find the code signing signature as recorded in this MMAP error.

[deny-mmap] mapped file has no team identifier and is not a platform binary: /private/var/mobile/

Containers/Bundle/Application/………../…………/libappwrap.dylib

n Workaround – Code Signing Signature

Regenerate the signing certificate and the mobile provisioning file and rewrap the application.Reupload the application and the regenerated auxiliary files in the Workspace ONE UEMconsole.

App Wrapping MD

VMware, Inc. 25

Developer Resources 6Find information for developers who work with wrapped apps. Identify what methods andlibraries to use with app wrapping and application management. You can also find informationabout various MADP vendors that Workspace ONE UEM has partnered for wrappingfunctionality. Finally, identify iOS APIs that you use and see if the Tunnel can meet your needs asan app wrapping alternative.

This chapter includes the following topics:

n Supported Developer Resources - iOS Wrapped Apps

n Supported Developer Resources -Android Wrapped Apps

n Mobile App Development Platform, MADP Support

n App Wrapping and Tunnel Support for iOS APIs

Supported Developer Resources - iOS Wrapped Apps

Find information on partial support, how to use the resource, or suggested informational sites.The lists are not comprehensive.

Features Options Supported by Workspace ONE UEM

Project Template Designates the methodto implement iOS applications.

Storyboards - Supported NIBs Only - Supported Master/Detail Template -Supported Tabbed Template - Supported

Networking Redirects HTTP and HTTPStraffic using the VMware Tunnel or otherproxies.

NSURLConnection - Supported NSURLSession- Supported ConfigureNSURLSession using . Not Supported: NSURLSession Download Task.AFNetworking Version 1 - Supported AFNetworking Version 2 - PartiallySupported Supported AFHTTPRequestOperationAFHTTPRequestOperationManager AFURLConnectionOperation NotSupported AFURLSessionManager AFHTTPSessionManagerASIHTTPRequest- Not Supported

Email Composing Prevents an applicationfrom using the native email client to sendemails using data loss preventionsettings.

MFMailComposeViewController- Supported Check the canSendEmailproperty before use. See the following site for more information: https://developer.apple.com/library/ios/documentation/MessageUI/Reference/MFMailComposeViewController_class/Reference/Reference.html#//apple_ref/doc/uid/TP40008200

VMware, Inc. 26

Features Options Supported by Workspace ONE UEM

Copy and Paste Prevents users fromcopying content from the wrappedapplication into other applications usingdata loss prevention settings.

UITextField - Supported UITextView - Supported UIWebView - SupportedWorkspace ONE UEM cannot block certain HTML input options in a Webpage.

Integrated Authentication Authenticates auser automatically against NTLM andbasic Web sites or Web services.

Web Service/Website Authentication - Supported Ensure the endpoint usesNTLM or basic authentication.

Camera Blocks access to the camerawithin the wrapped application.

UIImagePickerController- Supported Does not block picking from the photoroll. AVCaptureSession- Supported

iCloud Data Backup Blocks data fromsyncing with iTunes.

NSFileManager - Supported Blocks the property ubiquityIdentityToken usedto synchronize with iCloud.

Opening Documents in Other AppsBlocks wrapped applications fromopening documents in other applications.

UIDocumentInteractionController - Supported UIActivityViewController -Supported

Location Services Blocks wrappedapplications from using location servicesto retrieve the current location of thedevice

CLLocationManager Use the properties to check if services are availablebefore use. See the following site for more information: https://developer.apple.com/library/mac/documentation/CoreLocation/Reference/CLLocationManager_Class/CLLocationManager/CLLocationManager.html

Supported Developer Resources -Android Wrapped Apps

Find information on partial support, how to use the resource, or suggested informational sites.The lists are not comprehensive.

Features Options Supported by Workspace ONE UEM

Networking RedirectsHTTP and HTTPS trafficusing the VMware Tunnelor other proxies.

F5 - Supported Covers all App level http/https communications. VMware Tunnel - SupportedWorks at the following component levels. android/webkit/WebView android/webkit/WebViewClient com/squareup/okhttp/OkHttpClient java/net/URL org/apache/http/impl/client/AbstractHttpClient org/apache/http/impl/client/DefaultHttpClient org/apache/http/impl/client/HttpClientAndroidLib org/xwalk/core/XWalkView The VMware Tunnel supportsonly HTTP and HTTPS traffic, so you cannot use classes such as Socket().

Data At Rest EncrytionEncrypts data stored onthe application.

Java File I/O System - Supported Supports the following classes. java/io/FileInputStreamjava/io/FileReader java/io/FileOutputStream java/io/FileWriter Context > openFileInputContext > openFileOutput android/os/ParcelFileDescriptor (specific to the shared inputstream through the Content provider) java/io/File Database Support (SQL Lite) - SupportedNet.sql.cipher.SQLiteDatabase.openOrCreateDatabase(databaseFile, password, null)

Camera Blocks access tothe camera within thewrapped application.

android.hardware.Camera - Supported Restricts at the API level.MediaStore.ACTION_IMAGE_CAPTURE Intent - Supported Restricts at a device level.

Opening Documents inOther Apps Blockswrapped applicationsfrom opening documentsin other applications.

Intent.ACTION_VIEW - Supported Controls “Open File with” using the Intent approach startActivity.

App Wrapping MD

VMware, Inc. 27

Features Options Supported by Workspace ONE UEM

File Sharing withBluetooth Controlssharing files withBluetooth.

Intent.ACTION_SEND Intent.ACTION_CHOOSER - Supported Controls file sharing using theIntent approach start Activity.

Stream Sharing withBluetooth Controlsapplication in-builtBluetooth (point to point)communication.

BluetoothDevice.ACTION_ACL_CONNECTEDBluetoothAdapter.ACTION_DISCOVERY_STARTED - Supported

Location Access Controlsapplication locationchange listeningcapability.

LocationListener > OnLocation Changed(Location loc) - Supported In restricted mode, itblocks location update callbacks.

Mobile App Development Platform, MADP Support

A mobile app development platform (MADP) is a system that attempts to reduce thedevelopment effort for creating mobile applications. Workspace ONE UEM has partnered withvarious MADP vendors to ensure wrapping functionality on applications developed with theplatform.

VendorCertificationStatus Certification Notes

Adobe Phonegap Certified Wrapping functions with applications developed using Phonegap.

Appcelerator Certified Wrapping functions with applications developed using Appcelerator.

Cordova Certified Wrapping functions with applications developed using Cordova-basedplatforms.

IBM Worklight Certified Wrapping succeeds with applications developed using IBM Worklight.

Kony Certified Wrapping functions with applications developed using Kony.

MicroStrategy Use supported configurations from the AppConfig Community or use theSDK instead of wrapping. Due to partner integration with Microstrategy, theapp developer manually includes the SDK into the project for WorkspaceONE UEM specific functionalities. For example, App Tunneling and AppAuthentication (Passcode and Username/Password).

Oracle MAF Mobile Certified Wrapping functions with applications developed using Oracle MAF Mobile.

PegasystemsAntenna

Certified Wrapping functions with applications developed using PegasystemsAntenna.

Salesforce TouchPlatform

Certified Wrapping functions with applications developed using the Salesforce TouchPlatform.

SAP Certified Wrapping succeeds with applications developed using SAP.

Sencha Certified Wrapping functions with applications developed using Sencha.

App Wrapping MD

VMware, Inc. 28

VendorCertificationStatus Certification Notes

Telerik Certified Wrapping functions with applications developed using Telerik.

Xamarin Certified (withcaveats )

Wrapping functions with applications developed using Xamarin. Implementthe ModernHttpClient library. See https://github.com/paulcbetts/ModernHttpClient for more information. Caution: For iOS apps, wrapping isnot supported if Xamarin Insights is used because this addition can cause afailure to start. The Insights library is used for failure reporting and the SDK.The SDK also has a code for reporting that the SDK system injects into theapp during the time of wrapping. The two together can conflict and cause afailure.

App Wrapping and Tunnel Support for iOS APIs

This list is not comprehensive.

Key to Table

Option Description

Supported Supports using the API.

Not Supported Does not support using the API.

Researching Researching compatibility.

Partial support Supports using the API but not with on-demand features.

Compatible APIs

iOS APIiOS 7.X + AppWrapping

iOS 7.X + AWTunnel

iOS 8.X + AppWrapping

iOS 8.X + AWTunnel

iOS 9.X +AppWrapping

iOS 9.X + AWTunnel

NSURLSession –Data Task

Supported Supported Supported Researching Supported Supported

NSURLSession –Download Task

NotSupported

Supported NotSupported

Supported NotSupported

Supported

NSURLConnection Supported Supported Supported Researching Supported Supported

CFHTTP Supported Supported Supported Supported Supported Supported

CFSocket (TCP) Researching Researching Researching Researching Researching Supported

CFSocket (UDP) NotSupported

NotSupported

NotSupported

NotSupported

NotSupported

NotSupported

BSD networking(TCP)

NotSupported

Partialsupport

NotSupported

Partialsupport

NotSupported

Partialsupport

BSD networking(UDP)

NotSupported

NotSupported

NotSupported

NotSupported

NotSupported

NotSupported

BSD networking(DNS)

NotSupported

Partialsupport

NotSupported

Partialsupport

NotSupported

Partialsupport

App Wrapping MD

VMware, Inc. 29

iOS APIiOS 7.X + AppWrapping

iOS 7.X + AWTunnel

iOS 8.X + AppWrapping

iOS 8.X + AWTunnel

iOS 9.X +AppWrapping

iOS 9.X + AWTunnel

WKWebView NotSupported

NotSupported

NotSupported

NotSupported

NotSupported

NotSupported

UIWebView Supported Supported Supported Researching Supported Researching

Background tasks Researching Supported Researching Supported Researching Supported

App Wrapping MD

VMware, Inc. 30