Conjuring and providing profiles that manage execution of mobile applications
Various aspects of the disclosure relate to configuring and providing policies that manage execution of mobile applications. In some embodiments, a user interface may be generated that allows an IT administrator or other operator to set, change and/or add to policy settings. The policy settings can be formatted into a policy file and be made available for download to a mobile device, such as via an application store or to be pushed to the mobile device as part of a data push service. The mobile device, based on the various settings included in the policy file, may perform various actions to enforce the security constraints that are represented by the policy. The various settings that can be included in a policy are numerous and some examples and variations thereof are described in connection with the example embodiments discussed herein.
1. A method, comprising:
displaying, by one or more computing devices, a user interface that displays one or more policy settings for a managed application that is to be made available for download to a mobile device, wherein each of the one or more policy settings provides a constraint to be enforced by the mobile device prior to the managed application being provided access to at least one resource that is accessible through an access gateway;
receiving input via the user interface that creates or modifies a user authorization or user identification setting of the one or more policy settings, wherein the user authorization or user identification setting specifies a condition for authorizing or identifying a user in connection with the managed application being provided access to the at least one resource;
producing a policy file for the managed application that includes the user authorization or user identification setting, wherein the policy file is assigned to a first user role;
providing the policy file such that the policy is available for download to the mobile device;
receiving additional input specifying one or more additional policy settings, wherein the one or more additional policy settings includes an additional user authorization or user identification setting that specifies a constraint different from the one or more constraints that are specified by the user authorization or user identification setting;
producing an additional policy file for the managed application that includes the one or more additional policy settings, wherein the additional policy file is assigned to a second user role that is different from the first user role; and
providing the additional policy file for download in accordance with a requesting user that is assigned the second user role.
2. The method of claim 1 , wherein the policy file is an Extensible Markup Language (XML) file or a JavaScript Object Notation (JSON) file, and wherein the policy file includes one or more key/value pairs organized as a dictionary, wherein one key/value pair of the one or more key/value pairs corresponds to the user authorization or user identification setting.
3. The method of claim 1 , wherein the user authorization or user identification setting includes a setting group or category identifier; a setting dictionary name; a setting type; a range of possible setting values; a default setting value; a setting friendly name string; a setting unit display string; and a help text string.
4. The method of claim 1 , wherein the user authorization or user identification setting includes data specifying a ticket that is configured to provide authorization to create an application specific virtual private network (VPN) tunnel with the access gateway without requiring the user to provide credentials; and
wherein the user interface is configured to accept input specifying the ticket.
5. The method of claim 4 , wherein the user authorization or user identification setting includes an expiration period for the ticket; and
wherein the user interface is configured to accept input specifying the expiration period for the ticket.
6. The method of claim 1 , wherein the user authorization or user identification setting includes data specifying a manner in which the user is to log-on; and
wherein the user interface is configured to accept input specifying the manner in which the user is to log-on.
7. The method of claim 1 , wherein the user authorization or user identification setting includes a certificate that is usable by the mobile device when responding to certificate challenges; and
wherein the user interface is configured to accept input specifying the certificate.
8. The method of claim 1 , wherein the user authorization or user identification setting includes data specifying one or more conditions that must be satisfied by the mobile device in order for the mobile device to provide the user with single-sign on (SSO) functionality for authenticating the user with the access gateway.
9. The method of claim 8 , wherein the one or more conditions includes a location of the mobile device or an install of another application on the mobile device.
10. The method of claim 1 , wherein the providing the policy file includes publishing the policy file to an application store that also publishes the managed application.
11. The method of claim 1 , wherein providing the policy file includes pushing the policy file to the mobile device based on the mobile device being registered with a push service.
12. An apparatus, comprising:
at least one processor; and
memory storing executable instructions configured to, when executed by the at least one processor, cause the apparatus to:
display a user interface that displays one or more policy settings for a managed application that is to be made available for download to a mobile device, wherein each of the one or more policy settings provides a constraint to be enforced by the mobile device prior to the managed application being provided access to at least one resource that is accessible through an access gateway;
receive input via the user interface that creates or modifies a user authorization or user identification setting of the one or more policy settings, wherein the user authorization or user identification setting specifies a condition for authorizing or identifying a user in connection with the managed application being provided access to the at least one resource;
produce a policy file for the managed application that includes the user authorization or user identification setting, wherein the policy file is assigned to a first user role;
provide the policy file such that the policy is available for download to the mobile device;
receive additional input specifying one or more additional policy settings, wherein the one or more additional policy settings includes an additional user authorization or user identification setting that specifies a constraint different from the one or more constraints that are specified by the user authorization or user identification setting;
produce an additional policy file for the managed application that includes the one or more additional policy settings, wherein the additional policy file is assigned to a second user role that is different from the first user role; and
provide the additional policy file for download in accordance with a requesting user that is assigned the second user role.
13. The apparatus of claim 12 , wherein the policy file is an Extensible Markup Language (XML) file or a JavaScript Object Notation (JSON) file, and wherein the policy file includes one or more key/value pairs organized as a dictionary, wherein one key/value pair of the one or more key/value pairs corresponds to the user authorization or user identification setting.
14. The apparatus of claim 12 , wherein the user authorization or user identification setting includes a setting group or category identifier; a setting dictionary name; a setting type; a range of possible setting values; a default setting value; a setting friendly name string; a setting unit display string; and a help text string.
15. The apparatus of claim 12 , wherein the user authorization or user identification setting includes data specifying a ticket that is configured to provide authorization to create an application specific virtual private network (VPN) tunnel with the access gateway without requiring the user to provide credentials; and
wherein the user interface is configured to accept input specifying the ticket.
16. The apparatus of claim 15 , wherein the user authorization or user identification setting includes an expiration period for the ticket; and
wherein the user interface is configured to accept input specifying the expiration period for the ticket.
17. The apparatus of claim 12 , wherein the user authorization or user identification setting includes data specifying a manner in which the user is to log-on; and
wherein the user interface is configured to accept input specifying the manner in which the user is to log-on.
18. The apparatus of claim 12 , wherein the user authorization or user identification setting includes a certificate that is usable by the mobile device when responding to certificate challenges; and
wherein the user interface is configured to accept input specifying the certificate.
19. One or more non-transitory computer-readable media storing instructions configured to, when executed, cause at least one computing device to:
display a user interface that displays one or more policy settings for a managed application that is to be made available for download to a mobile device, wherein each of the one or more policy settings provides a constraint to be enforced by the mobile device prior to the managed application being provided access to at least one resource that is accessible through an access gateway;
receive input via the user interface that creates or modifies a user authorization or user identification setting of the one or more policy settings, wherein the user authorization or user identification setting specifies a condition for authorizing or identifying a user in connection with the managed application being provided access to the at least one resource;
produce a policy file for the managed application that includes the user authorization or user identification setting, wherein the policy file is assigned to a first user role;
provide the policy file such that the policy is available for download to the mobile device;
receive additional input specifying one or more additional policy settings, wherein the one or more additional policy settings includes an additional user authorization or user identification setting that specifies a constraint different from the one or more constraints that are specified by the user authorization or user identification setting;
produce an additional policy file for the managed application that includes the one or more additional policy settings, wherein the additional policy file is assigned to a second user role that is different from the first user role; and
provide the additional policy file for download in accordance with a requesting user that is assigned the second user role.
20. The method of claim 4 , wherein the one or more policy settings includes at least one first setting specifying that a private secure container, which is to be private to the managed application, is to be configured on the mobile device such that a read or write operation from the managed application is to be redirected to the private secure container, and wherein the one or more policy settings includes at least one second setting specifying that a shared secure container, which is to be accessible by at least one other managed application, is to be configured on the mobile device such that a read or write operation from the managed application is to be redirected to the shared secure container.