Microsoft Exchange Autodiscovery
The Autodiscover service of Exchange Server 2007 is supported. When you manually configure a device, Autodiscover uses your email address and password to automatically determine the correct Exchange server information. For information about enabling the Autodiscover service, see http://technet.microsoft.com/en-us/ library/cc539114.aspx.
Microsoft Exchange Global Address List
iPhone, iPod touch, and iPad retrieve contact information from your companys Exchange server corporate directory. You can access the directory when searching in Contacts, and its automatically accessed for completing email addresses as you enter them.
Additional Supported Exchange ActiveSync Features
In addition to the features and capabilities already described, iPhone OS supports: Creating calendar invitations. With Microsoft Exchange 2007, you can also view the status of replies to your invitations. Setting Free, Busy, Tentative, or Out of Office status for your calendar events. Searching mail messages on the server. Requires Microsoft Exchange 2007. Exchange ActiveSync client certificate-based authentication.
Unsupported Exchange ActiveSync Features
Not all Exchange features are supported, including, for example: Folder management Opening links in email to documents stored on SharePoint servers Task synchronization Setting an out of office autoreply message Flagging messages for follow-up
iPhone OS works with VPN servers that support the following protocols and authentication methods: L2TP/IPSec with user authentication by MS-CHAPV2 Password, RSA SecurID and CryptoCard, and machine authentication by shared secret. PPTP with user authentication by MS-CHAPV2 Password, RSA SecurID, and CryptoCard. Cisco IPSec with user authentication by Password, RSA SecurID, or CryptoCard, and machine authentication by shared secret and certificates. See Appendix A for compatible Cisco VPN servers and recommendations about configurations.
Cisco IPSec with certificate-based authentication supports VPN on demand for domains you specify during configuration. See VPN Settings on page 35 for details.

Network Security

iPhone OS supports the following 802.11i wireless networking security standards as defined by the Wi-Fi Alliance: WEP WPA Personal WPA Enterprise WPA2 Personal WPA2 Enterprise Additionally, iPhone OS supports the following 802.1X authentication methods for WPA Enterprise and WPA2 Enterprise networks: EAP-TLS EAP -TTLS EAP-FAST EAP-SIM PEAP v0, PEAP v1 LEAP
Certificates and Identities
iPhone, iPod touch, and iPad can use X.509 certificates with RSA keys. The file extensions.cer,.crt, and.der are recognized. Certificate chain evaluations are performed by Safari, Mail, VPN, and other applications. Use P12 (PKCS #12 standard) files that contain exactly one identity. The file extensions.p12 and.pfx are recognized. When an identity is installed, the user is prompted for the passphrase that protects it. Certificates necessary for establishing the certificate chain to a trusted root certificate can be installed manually or by using configuration profiles. You dont need to add root certificates that are included on the device by Apple. To view a list of the preinstalled system roots, see the Apple Support article at http://support.apple.com/kb/HT3580. Certificates can be securely installed over the air via SCEP. See Overview of the Authenticated Enrollment and Configuration Process on page 22 for more information.

Chapter 1 Deploying iPhone and iPod touch
Preparing Access to Network Services and Enterprise Data
iPhone OS 3.x software enables secure push email, push contacts, and push calendar with your existing Microsoft Exchange Server 2003 or 2007 solution, as well as Global Address Lookup, Remote Wipe, and device passcode policy enforcement. It also allows users to securely connect to company resources via WPA Enterprise and WPA2 Enterprise wireless networks using 802.1X wireless authentication and/or via VPN using PPTP, LT2P over IPSec, or Cisco IPSec protocols. If your company doesnt use Microsoft Exchange, your users can still use iPhone or iPod touch to wirelessly sync email with most standard POP or IMAP-based servers and services. And they can use iTunes to sync calendar events and contacts from Mac OS X iCal and Address Book or Microsoft Outlook on a Windows PC. For wireless access to calendars and directories, CalDAV and LDAP are supported. As you determine which network services you want users to access, refer to the information in the following sections.

Microsoft Exchange

iPhone communicates directly with your Microsoft Exchange Server via Microsoft Exchange ActiveSync (EAS). Exchange ActiveSync maintains a connection between the Exchange Server and iPhone or iPad Wi-Fi + 3G, so that when a new email message or meeting invitation arrives, the device is instantly updated. iPod touch and iPad Wi-Fi dont have a cellular connection, so they receive push notifications only when theyre active and connected to a Wi-Fi network. If your company currently supports Exchange ActiveSync on Exchange Server 2003 or Exchange Server 2007, you already have the necessary services in place. For Exchange Server 2007, make sure the Client Access Role is installed. For Exchange Server 2003, make sure youve enabled Outlook Mobile Access (OMA). If you have an Exchange Server but your company is new to Exchange ActiveSync, review the information in the following sections. Network Configuration Make sure port 443 is open on the firewall. If your company uses Outlook Web Access, port 443 is most likely already open. Verify that a server certificate is installed on the front-end Exchange server and turn on basic authentication only, in the Authentication Method properties, to require an SSL connection to the Microsoft Server ActiveSync directory of your IIS. If youre using a Microsoft Internet Security and Acceleration (ISA) Server, verify that a server certificate is installed and update the public DNS to properly resolve incoming connections.

If you want to configure URL-specific proxy settings, place a PAC file on a web server thats accessible with the basic VPN settings, and ensure that its served with a MIME type of application/x-ns-proxy-autoconfig. Alternatively, configure your DNS or DHCP to provide the location of a WPAD file on a server that is similarly accessible.

IMAP Email

If you dont use Microsoft Exchange, you can still implement a secure, standards-based email solution using any email server that supports IMAP and is configured to require user authentication and SSL. For example, you can access Lotus Notes/Domino or Novell GroupWise email using this technique. The mail servers can be located within a DMZ subnetwork, behind a corporate firewall, or both. With SSL, iPhone OS supports 128-bit encryption and X.509 certificates issued by the major certificate authorities. It also supports strong authentication methods including industry-standard MD5 Challenge-Response and NTLMv2. IMAP Network Setup Guidelines For additional security protection, install a digital certificate on the server from a trusted certificate authority (CA). Installing a certificate from a CA is an important step in ensuring that your proxy server is a trusted entity within your corporate infrastructure. See Credentials Settings on page 38 for information about installing certificates on iPhone. To let iPhone OS devices retrieve email from your server, open port 993 in the firewall and make sure that the proxy server is set to IMAP over SSL. To let devices send email, port 587, 465, or 25 must be open. Port 587 is used first, and is the best choice.

LDAP Directories

iPhone OS lets you access standards-based LDAP directory servers and provide a global address directory or other information similar to the Global Address List in Microsoft Exchange. When an LDAP account is configured on the device, the device searches for the attribute namingContexts at the servers root level to identify the default search base. The search scope is set to subtree by default.

CalDAV Calendars

CalDAV support in iPhone OS provides global calendars and scheduling for organizations that dont use Microsoft Exchange. iPhone OS works with calendar servers that support the CalDAV standard.

Subscribed Calendars

If you want to publish read-only calendars of corporate events, such as holidays or special event schedules, iPhone OS devices can subscribe to calendars and display the information alongside Microsoft Exchange and CalDAV calendars. iPhone OS works with calendar files in the standard iCalendar (.ics) format. An easy way to distribute subscribed calendars to your users is to send the fully qualified URL in SMS or email. When the user taps the link, the device offers to subscribe to the specified calendar.

Over-the-Air Enrollment and Configuration
Enrollment is the process of authenticating a device and user so that you can automate the process of distributing certificates. Digital certificates provide many benefits to users. They can be used to authenticate access to key enterprise services, such as Microsoft Exchange ActiveSync, WPA2 Enterprise wireless networks, and corporate VPN connections. Certificate-based authentication also permits the use of VPN On Demand for seamless access to corporate networks. In addition to using the over-the-air enrollment capabilities to issue certificates for your companys public key infrastructure (PKI), you can also deploy device configuration profiles. This ensures that only trusted users are accessing corporate services and that their devices are configured according to your IT policies. And because configuration profiles can be both encrypted and locked, the settings cannot be removed, altered, or shared with others. These capabilities are available to you in the over-the-air process described below, and also by using iPhone Configuration Utility to configure devices while theyre attached to your administrative computer. See Chapter 2 to learn about using iPhone Configuration Utility. Implementing over-the-air enrollment and configuration requires development and integration of authentication, directory, and certificate services. The process can be deployed using standard web services, and once its in place, it permits your users to set up their devices in a secure, authenticated fashion.
Overview of the Authenticated Enrollment and Configuration Process
To implement this process, you need to create your own profile distribution service that accepts HTTP connections, authenticates users, creates mobileconfig profiles, and manages the overall process described in this section. You also need a CA (certificate authority) to issue the device credentials using Simple Certificate Enrollment Protocol (SCEP). For links to PKI, SCEP, and related topics see Other Resources on page 27. The following diagram shows the enrollment and configuration process that iPhone supports.
Phase 1 - Begin Enrollment

Profile service

Enrollment request Device information request User: Anne Johnson sample sample
Attributes required: UDID, OS version, IMEI Challenge token: AnneJohnson1 URL for response: https://profiles.example.com

Grace period for device lock: Specifies how soon the device can be unlocked again after use, without re-prompting for the passcode. Maximum number of failed attempts: Determines how many failed passcode attempts can be made before the device is wiped. If you dont change this setting, after six failed passcode attempts, the device imposes a time delay before a passcode can be entered again. The time delay increases with each failed attempt. After the eleventh failed attempt, all data and settings are securely erased from the device. The passcode time delays always begin after the sixth attempt, so if you set this value to 6 or lower, no time delays are imposed and the device is erased when the attempt value is exceeded.

Restrictions Settings

Use this payload to specify which device features the user is allowed to use. Allow explicit content: When this is turned off, explicit music or video content purchased from the iTunes Store is hidden. Explicit content is marked as such by content providers, such as record labels, when sold through the iTunes Store. Allow use of Safari: When this option is turned off, the Safari web browser application is disabled and its icon removed from the Home screen. This also prevents users from opening web clips. Allow use of YouTube: When this option is turned off, the YouTube application is disabled and its icon is removed from the Home screen. Allow use of iTunes Music Store: When this option is turned off, the iTunes Music Store is disabled and its icon is removed from the Home screen. Users cannot preview, purchase, or download content. Allow installing apps: When this option is turned off, the App Store is disabled and its icon is removed from the Home screen. Users are unable to install or update their applications. Allow use of camera: When this option is turned off, the camera is completely disabled and its icon is removed from the Home screen. Users are unable to take photographs. Allow screen capture: When this option is turned off, users are unable to save a screenshot of the display.

Wi-Fi Settings

Use this payload to set how the device connects to your wireless network. You can add multiple network configurations by clicking the Add (+) button in the editing pane. These settings must be specified, and must match the requirements of your network, in order for the user to initiate a connection. Service Set Identifier: Enter the SSID of the wireless network to connect to. Hidden Network: Specifies whether the network is broadcasting its identity. Security Type: Select an authentication method for the network. The following choices are available for both Personal and Enterprise networks. None: The network doesnt use authentication. WEP: The network uses WEP authentication only. WPA/WPA 2: The network uses WPA authentication only. Any: The device uses either WEP or WPA authentication when connecting to the network, but wont connect to non-authenticated networks. Password: Enter the password for joining the wireless network. If you leave this blank, the user will be asked to enter it. Enterprise Settings In this section you specify settings for connecting to enterprise networks. These settings appear when you choose an Enterprise setting in the Security Type pop-up menu. In the Protocols tab, you specify which EAP methods to use for authentication and configure the EAP-FAST Protected Access Credential settings. In the Authentication tab, you specify sign-in settings such as user name and authentication protocols. If youve installed an identity using the Credentials section, you can choose it using the Identity Certificate pop-up menu. In the Trust tab, you specify which certificates should be regarded as trusted for the purpose of validating the authentication server for the Wi-Fi connection. The Trusted Certificates list displays certificates that have been added using the Credentials tab, and lets you select which certificates should be regarded as trusted. Add the names of the authentication servers to be trusted to the Trusted Server Certificates Names list. You can specify a particular server, such as server.mycompany.com or a partial name such as *.mycompany.com. The Allow Trust Exceptions option lets users decide to trust a server when the chain of trust cant be established. To avoid these prompts, and to permit connections only to trusted services, turn off this option and embed all necessary certificates in a profile.

Web Clip Settings

Use this payload to add web clips to the Home screen of the users device. Web clips provide fast access to favorite web pages. Make sure the URL you enter includes the prefix http:// or https://this is required for the web clip to function correctly. For example, to add the online version of the iPhone User Guide to the Home screen, specify the web clip URL: http://help.apple.com/iphone/ To add a custom icon, select a graphic file in gif, jpeg, or png format, 59 x 60 pixels in size. The image is automatically scaled and cropped to fit, and converted to png format if necessary.

Credentials Settings

Use this payload to add certificates and identities to the device. For information about supported formats, see Certificates and Identities on page 11. When installing credentials, also install the intermediate certificates that are necessary to establish a chain to a trusted certificate thats on the device. To view a list of the preinstalled roots, see the Apple Support article at http://support.apple.com/kb/HT2185. If youre adding an identify for use with Microsoft Exchange, use the Exchange payload instead. See Exchange Settings on page 36. Adding credentials on Mac OS X: 1 Click the Add (+) button. 2 In the file dialog that appears, select a PKCS1 or PKSC12 file, then click Open. If the certificate or identity that you want to install in your Keychain, use Keychain Access to export it in.p12 format. Keychain Access is located in /Applications/Utilities. For help see Keychain Access Help, available in the Help menu when Keychain Access is open. To add multiple credentials to the configuration profile, click the Add (+) button again. Adding credentials on Windows: 1 Click the Add (+) button. 2 Select the credential that you want to install from the Windows Certificate Store. If the credential isnt available in your personal certificate store, you must add it, and the private key must be marked as exportable, which is one of the steps offered by the certificate import wizard. Note that adding root certificates requires administrative access to the computer, and the certificate must be added to the personal store. If youre using multiple configuration profiles, make sure certificates arent duplicated. You cannot install multiple copies of the same certificate. Instead of installing certificates using a configuration profile, you can let users use Safari to download the certificates directly to their device from a webpage. Or, you can email certificates to users. See Installing Identities and Root Certificates on page 54 for more information. You can also use the SCEP Settings, below, to specify how the device obtains certificates over-the-air when the profile is installed.

SCEP Settings

The SCEP payload lets you specify settings that allow the device to obtain certificates from a CA using Simple Certificate Enrollment Protocol (SCEP).
Setting URL Name Description This is the address of the SCEP server. This can be any string that will be understood by the certificate authority, it can be used to distinguish between instances, for example. The representation of a X.500 name represented as an array of OID and value. For example, /C=US/O=Apple Inc./CN=foo/1.2.5.3=bar, which would translate to: [ [ [C US] ], [ [O Apple Inc.] ],., [ [ 1.2.5.3 bar ] ] ] , , , A pre-shared secret the SCEP server can use to identify the request or user. Select a key size, andusing the checkboxes below this fieldthe acceptable use of the key. If your Certificate Authority uses HTTP, use this field to provide the fingerprint of the CAs certificate which the device will use to confirm authenticity of the CAs response. during the enrollment process. You can enter a SHA1 or MD5 fingerprint, or select a certificate to import its signature.

iPhone, iPod touch, and iPad support Microsofts Autodiscover service, which uses your user name and password to determine the address of the front-end Exchange server. If the servers address cant be determined, youll be asked to enter it.
If your Exchange server listens for connections on a port other than 443, specify the port number in the Server field using the format exchange.example.com:portnumber.
After the Exchange account is successfully configured, the servers passcode policies are enforced. If the users current passcode doesnt comply with the Exchange ActiveSync policies, the user is prompted to change or set the passcode. The device wont communicate with the Exchange server until the user sets a compliant passcode. Next, the device offers to immediately sync with the Exchange server. If you choose not to sync at this time, you can turn on calendar and contact syncing later in Settings > Mail, Contacts, Calendars. By default, Exchange ActiveSync pushes new data to your device as it arrives on the server. If you prefer to fetch new data on a schedule or to only pull new data manually, use Settings > Mail, Contacts, Calendars > Fetch New Data to change the settings. To change how many days worth of mail messages are synced to your device, go to Settings > Mail, Contacts, Calendars, and then select the Exchange account. You can also select which folders, in addition to the inbox, are included in push email delivery.
To change the setting for calendar data go to Settings > Mail, Contacts, Calendars > Sync.
iPhone, iPod touch, and iPad can look up contact information on LDAP directory servers. To add an LDAP server, go to Settings > Mail, Contacts, Calendars > Add Account > Other. Then tap Add LDAP Account.
Enter the LDAP server address, and user name and password if required, then tap Next. If the server is reachable and supplies default search settings to the device, the settings will be used.
The following Search Scope settings are supported:
Search Scope setting Base One Level Subtree Description Searches the base object only. Searches objects one level below the base object, but not the base object itself. Searches the base object and the entire tree of all objects descended from it.
You can define multiple sets of search settings for each server.

Installing iTunes on Windows Computers
When you install iTunes on Windows computers, by default you also install the latest version of QuickTime, Bonjour, and Apple Software Update. You can omit these components by passing parameters to the iTunes installer, or by pushing only the components you want to install on your users computers.
Installing on Windows using iTunesSetup.exe If you plan to use the regular iTunes installation process but omit some components, you can pass properties to iTunesSetup.exe using the command line.
Property NO_AMDS=1 NO_ASUW=1 NO_BONJOUR=1 NO_QUICKTIME=1 Meaning Dont install Apple Mobile Device Services. This component is required for iTunes to sync and manage mobile devices. Dont install Apple Software Update for Windows. This application alerts users to new versions of Apple software. Dont install Bonjour. Bonjour provides zero-configuration network discovery of printers, shared iTunes libraries, and other services. Dont install QuickTime. This component is required to use iTunes. Dont omit QuickTime unless youre sure the client computer already has the latest version installed.
Silently Installing on Windows To silently install iTunes, extract the individual.msi files from iTunesSetup.exe, then push the files to client computers. To extract.msi files from iTunesSetup.exe: 1 Run iTunesSetup.exe. 2 Open %temp% and find a folder named IXPnnn.TMP, where %temp% is your temporary directory and nnn is a 3-digit random number. On Windows XP, the temporary directory is typically bootdrive:\Documents and Settings\user\Local Settings\temp\. On Windows Vista, the temporary directory is typically \Users\user\AppData\Local\Temp\. 3 Copy the.msi files from the folder to another location. 4 Quit the installer opened by iTunesSetup.exe. Then use Group Policy Object Editor, in the Microsoft Management Console, to add the.msi files to a Computer Configuration policy. Make sure to add the configuration to the Computer Configuration policy, not the User Configuration policy. Important: iTunes requires QuickTime and Apple Application Support. Apple Application Support must be installed before installing iTunes. Apple Mobile Device Services (AMDS) is necessary to use an iPhone, iPad, or iPod touch with iTunes. Before pushing the.msi files, you need to select which localized versions of iTunes you want to install. To do so, open the.msi in the ORCA tool, which is installed by the Windows SDK as Orca.msi, in bin\. Then edit the summary information stream and remove the languages that you dont want to install. (Locale ID1033 is English.) Alternatively, use the Group Policy Object Editor to change the deployment properties of the.msi files to Ignore Language.

Signing Applications

Applications you distribute to users must be signed with your distribution certificate. For instructions about obtaining and using a certificate, see the iPhone Developer Center at http://developer.apple.com/iphone.
Creating the Distribution Provisioning Profile
Distribution provisioning profiles let you create applications that your users can use on their device. You create an enterprise distribution provisioning profile for a specific application, or multiple applications, by specifying the AppID that is authorized by the profile. If a user has an application, but doesnt have a profile that authorizes its use, the user isnt able to use the application. The designated Team Agent for your enterprise can create distribution provisioning profiles at the Enterprise Program Portal at http://developer.apple.com/iphone. See the website for instructions. Once you create the enterprise distribution provisioning profile, download the.mobileprovision file, and then securely distribute it and your application.
Installing Provisioning Profiles Using iTunes
The users installed copy of iTunes automatically installs provisioning profiles that are located in the following folders defined in this section. If the folders dont exist, create them using the names shown.

Mac OS X

~/Library/MobileDevice/Provisioning Profiles/ /Library/MobileDevice/Provisioning Profiles/ the path specified by the ProvisioningProfilesPath key in ~/Library/Preferences/ com.apple.itunes

Windows XP

bootdrive:\Documents and Settings\username\Application Data\Apple Computer\ MobileDevice\Provisioning Profiles bootdrive:\Documents and Settings\All Users\Application Data\Apple Computer\ MobileDevice\Provisioning Profiles the path specified in the HKCU or HKLM by the ProvisioningProfilesPath registry key SOFTWARE\Apple Computer, Inc\iTunes
Chapter 5 Deploying Applications

Windows Vista

bootdrive:\Users\username\AppData\Roaming\Apple Computer\MobileDevice\ Provisioning Profiles bootdrive:\ProgramData\Apple Computer\MobileDevice\Provisioning Profiles the path specified in the HKCU or HKLM by the ProvisioningProfilesPath registry key SOFTWARE\Apple Computer, Inc\iTunes iTunes automatically installs provisioning profiles found in the locations above onto devices it syncs with. Once installed, the provisioning profiles can be viewed on the device in Settings > General > Profiles. You can also distribute the.mobileprovision file to your users and have them drag it to the iTunes application icon. iTunes will copy the file to the correct location as defined above.
Installing Provisioning Profiles Using iPhone Configuration Utility
You can use iPhone Configuration Utility to install provisioning profiles on connected devices. Follow these steps: 1 In iPhone Configuration Utility, choose File > Add to Library, and then select the provisioning profile that you want to install. The profile is added to iPhone Configuration Utility and can be viewed by selecting the Provisioning Profiles category in the Library. 2 Select a device in the Connected Devices list. 3 Click the Provisioning Profiles tab. 4 Select the provisioning profile in the list, and then click its Install button.

Installing Applications Using iTunes
Your users use iTunes to install applications on their devices. Securely distribute the application to your users and then have them follow these steps: 1 In iTunes, choose File > Add to Library and select the application (.app) you provided. You can also drag the.app file to the iTunes application icon. 2 Connect a device to the computer, and then select it in the Devices list in iTunes. 3 Click the Applications tab, and then select the application in the list. 4 Click Apply to install the application and all distribution provisioning profiles that are located in the designated folders discussed in Installing Provisioning Profiles Using iTunes on page 64.
Installing Applications Using iPhone Configuration Utility
You can use iPhone Configuration Utility to install applications on connected devices. Follow these steps: 1 In iPhone Configuration Utility, choose File > Add to Library, and then select the application that you want to install. The application is added to iPhone Configuration Utility and can be viewed by selecting the Applications category in the Library. 2 Select a device in the Connected Devices list. 3 Click the Applications tab. 4 Select the application in the list, and then click its Install button.
Using Enterprise Applications
When a user runs an application that isnt signed by Apple, the device looks for a distribution provisioning profile that authorizes its use. If a profile isnt found, the application wont open.
Disabling an Enterprise Application
If you need to disable an in-house application, you can do so by revoking the identity used to sign the distribution provisioning profile. The application will no longer be able to be installed, and if its already installed, it will no longer open.
For more information about creating applications and provisioning profiles, see: iPhone Developer Center at http://developer.apple.com/iphone/
Cisco VPN Server Configuration
Use these guidelines to configure your Cisco VPN server for use with iPhone, iPod touch and iPad. Supported Cisco Platforms
iPhone OS supports Cisco ASA 5500 Security Appliances and PIX Firewalls configured with 7.2.x software or later. The latest 8.0.x software release (or later) is recommended. iPhone OS also supports Cisco IOS VPN routers with IOS version 12.4(15)T or later. VPN 3000 Series Concentrators dont support iPhone VPN capabilities.

Authentication Methods

iPhone OS supports the following authentication methods: Pre-shared key IPSec authentication with user authentication via xauth Client and server certificates for IPSec authentication with optional user authentication via xauth Hybrid authentication where the server provides a certificate and the client provides a pre-shared key for IPSec authentication; user authentication is required via xauth. User authentication is provided via xauth and includes the following authentication methods: User name with password RSA SecurID CryptoCard

asa(config-webvpn)# ip local pool vpn_users 10.0.0.1-10.0.0.254 mask 255.255.255.255.
When using the recommended address mask, some routes assumed by the VPN configuration might be ignored. To avoid this, make sure that your routing table contains all necessary routes and verify that the subnet addresses are accessible before deployment.

Other Supported Features

iPhone, iPod touch, and iPad support the following features: Application Version: The client software version is sent to the server, allowing the server to accept or reject connections based on the devices software version. Banner: The banner, if configured on the server, is displayed on the device and the user must accept it or disconnect. Split Tunnel: Split tunneling is supported. Split DNS: Split DNS is supported. Default Domain: Default domain is supported.
Configuration Profile Format
This appendix specifies the format of mobileconfig files for those who want to create their own tools.
This document assumes that youre familiar with the Apple XML DTD and the general property list format. A general description of the Apple plist format is available at www.apple.com/DTDs/PropertyList-1.0.dtd. To get started, use iPhone Configuration Utility to create a skeleton file that you can modify using the information in this appendix. This document uses the terms payload and profile. A profile is the whole file that configures certain (single or multiple) settings on iPhone, iPod touch, or iPad. A payload is an individual component of the profile file.

Root Level

At the root level, the configuration file is a dictionary with the following key/value pairs:
Key PayloadVersion Value Number, mandatory. The version of the whole configuration profile file. This version number designates the format of the whole profile, not the individual payloads. String, mandatory. This is usually a synthetically generated unique identifier string. The exact content of this string is irrelevant; however, it must be globally unique. On Mac OS X, you can generate UUIDs with /usr/bin/uuidgen. String, mandatory. Currently, only Configuration is a valid value for this key. String, optional. This value describes the issuing organization of the profile, as displayed to the user.

PayloadUUID

PayloadType PayloadOrganization

Appendix

Key PayloadIdentifier
Value String, mandatory. This value is by convention a dot-delimited string uniquely describing the profile, such as com.myCorp.iPhone.mailSettings or edu.myCollege.students.vpn This is the string by which profiles. are differentiatedif a profile is installed which matches the identifier of another profile, it overrides it (instead of being added). String, mandatory. This value determines a very short string to be displayed to the user describing the profile, such as VPN Settings It does not have to be unique. String, optional. This value determines what descriptive, freeform text will be shown to the user on the Detail screen for the entire profile. This string should clearly identify the profile so the user can decide whether to install it. Array, optional. This value is the actual content of the profile. If it is omitted, the whole profile has no functional meaning. Boolean, optional. Default is No. If set, the user wont be able to delete the profile. A profile with this set can be updated via USB or web/email only if the profile identifier matches and is signed by the same authority. If a removal password is provided, the profile can be deleted by specifying the password. With signed and encrypted profiles, having this locking bit in plain view is without consequence because the profile cant be altered and this setting is also shown on the device.

manualFetchingWhenRoaming maxGracePeriod

Email Payload

The email payload is designated by the com.apple.mail.managed PayloadType value. This payload creates an email account on the device. In addition to the settings common to all payloads, this payload defines the following:
Key EmailAccountDescription EmailAccountName Value String, optional. A user-visible description of the email account, shown in the Mail and Settings applications. String, optional. The full user name for the account. This is the user name in sent messages, etc.

Key EmailAccountType

Value String, mandatory. Allowed values are EmailTypePOP and EmailTypeIMAP. Defines the protocol to be used for that account. String, mandatory. Designates the full email address for the account. If not present in the payload, the device prompts for this string during profile installation. String, mandatory. Designates the authentication scheme for incoming mail. Allowed values are EmailAuthPassword and EmailAuthNone. String, mandatory. Designates the incoming mail server host name (or IP address). Number, optional. Designates the incoming mail server port number. If no port number is specified, the default port for a given protocol is used. Boolean, optional. Default Yes. Designates whether the incoming mail server uses SSL for authentication. String, mandatory. Designates the user name for the email account, usually the same as the email address up to the @ character. If not present in the payload, and the account is set up to require authentication for incoming email, the device will prompt for this string during profile installation. String, optional. Password for the Incoming Mail Server. Use only with encrypted profiles. String, optional. Password for the Outgoing Mail Server. Use only with encrypted profiles.

EmailAddress

IncomingMailServerAuthentication
IncomingMailServerHostName IncomingMailServerPortNumber
IncomingMailServerUseSSL IncomingMailServerUsername
IncomingPassword OutgoingPassword
OutgoingPasswwordSameAsIncomi Boolean, optional. If set, the user will be prompted for the ngPassword password only once and it will be used for both outgoing and incoming mail. OutgoingMailServerAuthentication String, mandatory. Designates the authentication scheme for outgoing mail. Allowed values are EmailAuthPassword and EmailAuthNone. String, mandatory. Designates the outgoing mail server host name (or IP address). Number, optional. Designates the outgoing mail server port number. If no port number is specified, ports 25, 587 and 465 are used, in this order. Boolean, optional. Default Yes. Designates whether the outgoing mail server uses SSL for authentication. String, mandatory. Designates the user name for the email account, usually the same as the email address up to the @ character. If not present in the payload, and the account is set up to require authentication for outgoing email, the device prompts for this string during profile installation.

OutgoingMailServerHostName OutgoingMailServerPortNumber
OutgoingMailServerUseSSL OutgoingMailServerUsername

Web Clip Payload

The Web Clip payload is designated by the com.apple.webClip.managed PayloadType value. In addition to the settings common to all payloads, this payload defines the following:
Key URL Label Icon Value String, mandatory. The URL that the Web Clip should open when clicked. The URL must begin with HTTP or HTTPS or it wont work. String, mandatory. The name of the Web Clip as displayed on the Home screen. Data, optional. A PNG icon to be shown on the Home screen. Should be 59 x 60 pixels in size. If not specified, a white square will be shown. Boolean, optional. If No, the user cannot remove the Web Clip, but it will be removed if the profile is deleted.

IsRemovable

Restrictions Payload
The Restrictions payload is designated by the com.apple.applicationaccess PayloadType value. In addition to the settings common to all payloads, this payload defines the following:
Key allowAppInstallation Value Boolean, optional. When false, the App Store is disabled and its icon is removed from the Home screen. Users are unable to install or update their applications. Boolean, optional. When false, the camera is completely disabled and its icon is removed from the Home screen. Users are unable to take photographs. Boolean, optional. When false, explicit music or video content purchased from the iTunes Store is hidden. Explicit content is marked as such by content providers, such as record labels, when sold through the iTunes Store. Boolean, optional. When false, users are unable to save a screenshot of the display. Boolean, optional. When false, the YouTube application is disabled and its icon is removed from the Home screen. Boolean, optional. When false, the iTunes Music Store is disabled and its icon is removed from the Home screen. Users cannot preview, purchase, or download content. Boolean, optional. When false, the Safari web browser application is disabled and its icon removed from the Home screen. This also prevents users from opening web clips.

allowCamera

allowExplicitContent
allowScreenShot allowYouTube allowiTunes

allowSafari

LDAP Payload
The LDAP payload is designated by the com.apple.ldap.account PayloadType value. Theres a one-to-many relationship from LDAP Account to LDAPSearchSettings. Think of LDAP as a tree. Each SearchSettings object represents a node in the tree to start the search at, and what scope to search for (node, node+1 level of children, node + all levels of children). In addition to the settings common to all payloads, this payload defines the following:

Introducing Universal Applications for iPhone OS

Introduction

With the introduction of iPad, iPhone SDK 3.2 now supports development of three types of applications: iPhone apps, iPad apps and Universal apps. iPhone Applications. iPhone applications are optimized to run on iPhone and iPod touch. These applications run on iPad in their original resolution or can be optionally set to be pixel- doubled to accommodate for the larger display. iPad Applications. iPhone SDK 3.2 supports the development of iPad applications that are optimized to take advantage of iPad features, but run only on iPad. Universal Applications. iPhone SDK 3.2 supports the development of Universal applications. A Universal app is optimized to run on all iPhone OS devicesits essentially an iPhone app and an iPad app built as a single binary. This document covers the guidelines you should follow to create well-designed Universal applications. A Universal app can determine which device its running on and provide the best experience for that device. Well-designed Universal apps leverage a devices unique hardware features, provide the right choice of user interface elements, and use only the functionality that is supported by that device. Apple recommends that iPhone OS developers design, code and build their applications as Universal applications. Building apps as Universal apps makes it easier for everyone. Its easier for developers because theres only one app to manage on the App Store. Its easier for users because theyll know that it runs on any device they own.

Design for Universal

Whether youre thinking of optimizing an existing iPhone application or creating a brand new one that takes advantage of iPad, you should take the opportunity to design your apps as Universal apps. An important approach to designing a Universal application for iPhone OS is to think about how user interaction can be separated from the underlying application code. The iPhone SDKs classes and APIs leverage a model-view-controller (MVC) paradigm that encourages a clean separation of your application data and logic from the views used to present that data. The rst step in making a Universal app is to create user interface designs for each of the form factorsone design for iPad devices and another for iPhone/iPod touch devices. Much of your design will be affected by the features you want to expose in each of the different form factors. The following are some examples of user interactions to think about as you separate your iPad designs from your iPhone/iPod touch designs:. Orientation Using the accelerometer, its possible for an application to detect the current orientation of an iPhone OS device. With that information its possible for an app to optimize the user experience using alternative layouts to accommodate for the orientation. This is supported by a number of iPhone applications, including Mail, iPod and Photos. While its not always desirable to support multiple orientations for an iPhone app, its very important that all applications support multiple orientations when running on iPad. Use the larger iPad screen to give people access to more information in one place, to increase focus on the content that people want, to atten the hierarchy of screens in your app, to drastically reduce full-screen transitions, and to add realism, physicality, and stunning graphics to your applications user interface. The larger size of iPads screen makes a wider variety of gestures possible. For example, its conceivable that a user could perform a gesture with four ngers on iPad, but would probably not nd it easy on iPhone or iPod touch. A welldesigned Universal app design would accommodate differences in gesture-based input.

Layout

Gestures

Split views

A split view is a unique capability of iPad which provides a new way for an application to present information side-byside. Its important to carefully consider how to take advantage of the exibility that split view offers on iPad, while still providing users access to the same information when the application is running on an iPhone or iPod touch. Similar to split views, popovers present a new way to present options to users. A well-designed Universal application will present the same options on iPhone and iPod touch using existing iPhone application user interface paradigms. iPad, iPhone and iPod touch share much of the same hardware functionality. If you take advantage of a hardware feature thats not available on other devices, you should ensure that the lack of hardware on the other devices is handled gracefully. For example, an application running on iPad or iPod touch would not present the option to take a picture with a camera, but it could present them choices of images from the users Photo library.

Popovers

Hardware features

Conditional Coding

In order to achieve your design goals for a Universal application, you will need to use conditional coding to determine the availability of features when your app is running. Conditional coding allows you to make sure youre loading the right resources, using functionality thats supported by the device and properly leveraging hardware thats available. Remember to make conditional code decisions at the most granular level you can. Try to avoid making assumptions based on device type or an OS version number. If you need to follow alternate code paths based on a method, then check for that method, not whether youre currently running on a specic device type. Making code path decisions at the lowest possible level allows your app to automatically pick up new functionality when that method or class is introduced in an OS software update, your app will now have the functionality without you having to create an update. These are the categories of things that you may need to conditionally code for:

Resources

Interface Builder les (nibs). In your code, you need to recognize which platform youre running on and load the appropriate resources for each. For example, to ensure you present the right interface for your application you may need two nibs for a view, one that contains the controls for an iPhone interface and the other for the iPad interface. Your code will need to check to see which device youre running on and choose the appropriate nib le. Graphics. And you will probably want to load different resources for each device. For example, your iPad graphics might be larger than your iPhone graphics.

Classes

Some Cocoa Touch classes are only available on certain devices. Before you use a class, you need to check whether the class is available. For example, iPhone OS 3.2 allows your app to share documents with other applications. That functionality is only available for iPad. Your code would test for the existence of the UIDocumentInteractionController class using NSClassFromString() which will return a valid class object if this class exists or nil if it doesnt. If the class does exist, your code can use it and share documents. If not, youll need to work around it so the app works properly on devices that dont support sharing documents.

Methods and functions

Some devices support different methods and functions. If you are using functions on one device that dont exist on the other you need to weak-link to those functions and perform runtime checks before you call those methods. The base class for most Cocoa objects, NSObject, has built in support for runtime checking of method availability. The methods

instancesRespondToSelector and respondsToSelector
let you determine if an object or its superclasses have the method you want to use on the device youre running on. For example, if you want to search an NSString using a regular expression you would test the NSString class to see if it responds to NSRegularExpressionSearch. If it does then you would invoke the search in the NSString class. If the result is NO, then you would switch code paths to use the regular expression searching code you are using on iPhone prior to iPad.
New APIs in existing Frameworks
New APIs added to frameworks work in a similar fashion. For example, UIGraphics for iPad adds support for PDF destinations. In this case UIGraphics exists on all version of iPhone OS, so you would not be checking for the framework. Your code would check for the specic PDF functions that you want to use. Your code would compare a function name like UIGraphicsBeginPDFPage against NULL, if its equal to NULL then you know that the function is not available on this device. If its not NULL, your code continues to use that function.

Hardware capabilities

Sometimes it's necessary to detect whether certain hardware is available. You would use the same methodology you use to see if a software method or function is available, for example if you were trying to determine if the device you were on had a camera, you would query the UIImagePickerController for the UIImagePickerControllerSourceTypeCamera source, and make a programatic decision from there if this returns false.
The SDK Compatibility Guide contains detailed information on weak-linking and building code that takes advantage of different frameworks and available APIs. The code sample MailComposer demonstrates the actual code you can use to make your app congure itself dynamically to take advantage of the OS features you have available at runtime. Building a Universal app will reward your customers with a great experience no matter what device they run your application on, and will make management of your apps on the App Store simpler. Design well, write good conditional code, and build great apps!
2010 Apple Inc. All rights reserved. iPhone, iPad, iPod, iPod touch, Apple, and the Apple logo are trademarks of Apple Inc., registered in the U.S. and other countries.