The IBM Connections Meetings application on iOS has the ability to be managed by MaaS360 Device Management. This article describes the capabilities provided by this environment and how to take advantage of them in your deployment.

If your organization does not use MaaS360 Device Management, then you can skip this article. IBM Connections Meetings will continue to run normally in environments that are not managed by MaaS360.

Minimum Requirements

The following components are required at the specified minimum levels.

• Fiberlink MaaS360 v2.6

• IBM Connections Meetings for iOS version 9.3.0 or later

Managed Application Management (MAM)

As described above, IBM Connections Meetings can operate in two different modes: managed, where MaaS360 Device Management is in use and manages application security, and unmanaged, where an organization does not use MaaS360 (or does not use it for managing applications). When an organization decides to deploy MaaS360, or remove it from their environment, applications must somehow discover and switch to the new mode.

One typical case occurs when an organization has MaaS360 Device Management deployed and begins to use IBM Connections Meetings. The simplest approach for managing the Meetings application is to first install the MaaS360 client on the managed device and set up the security policiesand personason the MaaS360 server. When IBM Connections Meetings is installed and starts, it will detect that MaaS360 is installed and configured, and will change its behavior accordingly. This may include auto-configuring the client to use the corporate meeting servers

If an organization deploys MaaS360 after Meetings is already in use, then the next time the Meetings application starts, it will detect MaaS360 and change to managed mode. In either case, you can tell if Meetings is in managed by looking at the "About" screen. If this screen contains a "Managing Agent" section, then Meetings is in managed mode. If not, then it is in unmanaged mode.

Administration

The Policies, Users, and Devices managed by MaaS360 server are administered online at http://portal.fiberlink.com See the MaaS360 MDM Admin Guide for more details on how to use this web-based console.

Key Features of MaasS360 for IBM Connections Meetings on iOS

When a 3^rd party application such as IBM Connections Meetings incorporates the MaaS360 SDK libraries, the following security features can be enabled:

• Set a timeout for single sign-on login across your managed applications

• Enforce device compliance checks (ie., checks for jail broken devices, etc)

• Restrict copy and paste to unmanaged applications

• Allow sharing of library files based on file extension

• Restrict sharing of library files to a set of white-listed applications

• Receive alerts of compliance violations

• Automatically deliver and update policies remotely to to the application container based on user and device security posture

• Automatically deliver and update configuration data to the application

Current Limitations

• IBM Connections Meetings has not integrated MaaS360's screen-shot restrictions. It is possible for the user to capture an image of sensitive information displayed by the IBM Connections Meetings application. 

   

Behavioral differences when IBM Connections Meetings is in managed mode

When IBM Connections Meetings is in managed mode, the application:

• Will not respect the mobile.* security parameters in the meeting server config file (the associated policies will be managed via the MaaS360 Configuration File)

• May be affected by certain MaaS360 policy restrictions such as use of the microphone or camera

• Will not allow user modifications of server configurations provided by the MaaS360 configuration file

Data Sharing Controls

The data leak prevention settings are described in the MaaS360 administration documentation. These policies can be applied to IBM Connections Meetings by enabling Data Protection Policies in the Security settings of the MaaS360 persona assigned to the device.

The Restrict File Export settings in the persona are similar to functions available via mobile.* parms in the Sametime Meeting server config file. For example, the server config parm mobile.allowLibraryExport allows administrators to restrict sharing of all library files with other apps on the device. The MaaS360 persona includes the same capability but at a more granular level (for example, what file types can be shared and a white list of apps that library files can be shared with). When IBM Connections Meetings is in a managed mode in the MaaS360 environment, it follows a simple rule when deciding which policy to follow -- the IBM Connections Meetings mobile.* server security config parms are ignored and the application behavior is dictated by the MaaS360 persona and configuration file settings.

Data sharing, as it relates to IBM Connections Meetings, deals with how documents in the library are handled. With iOS, data is shared between applications using the Open In action. While inside a meeting room, the user can open the library view and tap a document to display an action sheet for that document. If not restricted by the administrator, Open In will be listed as one of these actions and when selected, will display a list of applications that are applicable to the selected document. Selecting an application in the list will share the document with that application. At this point, IBM Connections Meetings can no longer protect the security of the document. With this in mind, an administrator can use settings in the Securitysection of the MaaS360 WorkPlace Persona to control the behavior or Open In...

• Never allow the Open In action by setting the Restrict File Export policy to Yes.

• Always allow the Open In action to any applicable application by setting the Restrict File Export policy to No.

• Only allow the Open In action to a set of trusted applications by setting the Restrict File Export policy to Yes and defining a white list for those trusted applications.

Administrators can also allow Open In for a specific set of file extensions.  If the user selects a library document having one of these extensions, Open In will be allow without respect to the white list.

Data Security

In a MaaS360 environment, managed apps like IBM Connections Meetings are notified by MaaS360 when the application data needs to be restricted or erased. This may happen because the device has been lost, has gone out of compliance, the device has been jail broken, the user has left the company, and so on. When this happens, IBM Connections Meetings, like any other MaaS360 managed application, will block the application UI and present the user with a message (determined by the administrator or MaaS360) why the app is no longer available. Additionally, if required by the policy, the server configurations used by the IBM Connections Meetings app and all local data will be erased.

Meeting Server Mobile Security policies

As mentioned above, the mobile specific security policies specified by the mobile.* parameters in the meeting server configuration file will now be managed by some aspect of MaaS360, either the data security policies or a parameter in a Maas360 configuration file.  Managed instances of the IBM Connections Meetings app will adhere to the policies set forth by MaaS360. Unmanaged apps will continue to adhere to the policy set forth by the meeting server configuration file. 

Note:  Managed apps will still adhere to room and user policies defined by the Sametime System console except in cases where the console setting is in direct conflict with a MaaS360 policy. The MaaS360 policy will win any conflict. In the case where the policy is managed by a parameter in the MaaS360 config file and that parameter is not specified in the MaaS360 configuration file, the policy will take on the default value. It will not in any case revert to the setting in the meetings configuration file.

The following table shows the mobile security policies that can currently be set by the meeting server configuration file, and how they will now be managed by MaaS360. 

Application Specific Configuration

A key feature of the MaaS360 server is the ability for an administrator to upload an application specific configuration file for each managed application. The contents of that file will be pushed to the device and made available to the managed applications at initial startup or whenever the running app is brought back to the foreground. A configuration file generally specifies connectivity parameters for one or more enterprise servers as well as other parameters that may control how the application behaves in a managed environment. Using a configuration file is optional but is highly encouraged so users with managed devices are up and running as soon as a managed application, such as IBM Connections Meetings, is installed and started for the first time. Please see the table below for a list of all the possible configuration parameters supported by the IBM Connections Meetings app.

In general, the IBM Connections Meetings app is self configuring when it comes to the meeting servers. When a user attempts to join a meeting room using the Schedule Meetings View, a room URL or by entering a Connections Cloud meeting ID, the associated server will be configured automatically and the user will only be prompted for their credentials. However, it should be noted that if your meeting server is secured behind a corporate firewall and your mobile devices use an Authenticating Proxy rather than a VPN, the auto-configuration feature, in most cases, will not yield a working configuration. In this case, if a configuration file has not been provided by the administrator, the user will be required to configure the server manually.

The configuration parameters are specified as a series of key-value pairs and the extension of the file must be .txt. Both the key and the value are strings as shown here: 

com.ibm.mobile.meetings.serverURL = https://acme.meeting.server.com:443

com.ibm.mobile.meetings.serverName = ACME Meetings Server

com.ibm.mobile.meetings.allowUntrustedSSL = false

All parameters specific to IBM Connections Meetings have keys that start with com.ibm.mobile.meetings. Keys that start with com.ibm.mobile.meetings.appSetting are general settings that apply to the application, while keys that do not have the appSetting term apply to Sametime meeting server configurations. This key naming scheme allows an administrator to build one MaaS360 configuration file for all IBM apps, such as Traveler, Connections, Meetings and Chat. Each application will only read and process their own configuration parameters.

The complete list of supported parameters are as follows. If a parameter is not specified in a configuration file then the default value for that parameter is assumed.

IBM Connections Meetings General Application Setting Configuration Parameters

IBM Connections Meetings Server Configuration Parameters

Configuring Multiple Meeting Servers using the MaaS360 Configuration file

Some customers use more than one meeting server in their enterprise. When this is the case, the server specific parameters listed in the table above can be specified with a suffix for the second server configuration as shown here: 

com.ibm.mobile.meetings.serverURL= https://acme.meetings.com

com.ibm.mobile.meetings.serverName = ACME Meetings Server

com.ibm.mobile.meetings.allowUntrustedSSL = false

com.ibm.mobile.meetings.serverURL.test = https://acme.test.meetings.com

com.ibm.mobile.meetings.serverName.test = ACME Test Meetings Server

com.ibm.mobile.meetings.allowUntrustedSSL.test = true

If only one meeting server is being configured, an index is not required and the parameters can be specified as shown in the above table. All parameters for a second server should use the same index, and yet a different index for a third server and so on. Parameters with matching indexes will be taken together to create a single configuration.

Note:  Client specific parameters, such as com.ibm.mobile.meetings.appSetting.problemReportEmail,should not be specified with an index as they only need to be specified once.

Modifying Meeting Servers

Once a meeting server has been configured using the MaaS360 configuration file, it cannot be modified using the application settings. The only exception is the user credentials. A user can change the user ID or password, or indicate that they want to join meetings on that particular server as a guest. If the user ID is is modified by the user, then subsequent configuration updates will not override the value entered by the user.

If a meeting server is configured by the MaaS360 configuration file and then is removed from the configuration file, the server will also be removed from the client configuration. 

Configuring the IBM Connections Cloud Meeting Server

All the connectivity information needed for IBM Connections Cloud Meetings is already known by the IBM Connections Meetings mobile client.  However, the administrator may still want to manage the behavior of the client when using IBM Connections Cloud meeting rooms. This can be accomplished by specifying a configuration for the IBM Connections Cloud meetings server in the MaaS360 Configuration file. Using a serverUrl value of Cloud will indicate that an IBM Connections Cloud meeting server should be configured. As an example, if an administrator wants to configure the IBM Connections Cloud Meetings server but does not want the user to be able to save room passwords, the following configuration could be used:

com.ibm.mobile.meetings.serverURL= Cloud

com.ibm.mobile.meetings.enableRoomPasswordSave = false

The actual IBM Connections Cloud data center used with this configuration will be determined by the com.ibm.mobile.meetings.user parameter. If this parameter is not specified, the user will be prompted for credentials on first use of the IBM Connections Cloud meeting server. If a user provides a user ID, it will determine the data center. If the user chooses guest access, then the meeting room being joined will determine the data center.

It should be noted that once a serverUrl of Cloud has been specified, the following connectivity related configuration parameters for that server will be ignored if they are specified: 

com.ibm.mobile.meetings.serverName

com.ibm.mobile.meetings.allowUntrustedSSL

com.ibm.mobile.meetings.authProxyEnabled

com.ibm.mobile.meetings.authProxyUrl

com.ibm.mobile.meetings.authProxyReuseCredentials