Self Service for Mac and Mobiles at CERN Tim Bell, Michal Kwiatek, Maciej Muszkowski, Vincent Bippus...

CERN MDM at HEPiX 1

Self Service for Mac and Mobiles at CERNTim Bell, Michal Kwiatek, Maciej Muszkowski, Vincent Bippus (IT-OIS)

12/10/2015

CERN MDM at HEPiX 2

Today’s agenda

12/10/2015

• Introduction• Mac self-service• Managed iOS• VPP • Summary

CERN MDM at HEPiX 3

PC usage is pretty flat at CERN

12/10/2015

01/13 08/13 03/14 09/14 04/15 10/15 05/160

2000

4000

6000

8000

10000

12000

14000

Active PCs and Macs on CERN site

WindowsMacintosh

Date

Com

pute

rs

CERN MDM at HEPiX 4

Mobile Devices at CERN

12/10/2015

10/12 05/13 11/13 06/14 12/14 07/15 01/160

500

1000

1500

2000

2500

3000

3500

4000

Active Mobiles at CERN

AndroidiPhoneiPadiPodSymbianWindows

Date

Devi

ces

MDM at ITTF 5

BYOD or COPE?

22 May 2015

professional use

private use

CERN-ownedUser-owned

iPad of an RP

techician

Android phone

from the CERN Stores

PC or Mac from

CERN Stores

Personal Shared

Smartphone

COPE: Corporate Owned, personally enabled

PC or Mac

FB iPad

MDM at ITTF 6

Mobile Device Management Market

22 May 2015

• Apple ProfileManager (iOS, Mac)

• Absolute Manage (iOS, Android, Mac)

• Microsoft InTune + SCCM (iOS, Android, Mac)

• JAMF Casper Suite (iOS, Mac, Android)

• FileWave (iOS, Android, Mac)

• MobileIron (iOS, Android, Mac)

MDM at ITTF 7

MDM test results

22 May 2015

• No single product covered Android, iOS and Mac

• JAMF Casper Suite works well for iOS and Mac• Mature (13 years experience)• Large community of sys admins (20,000)• Key player for Mac OS and iOS• Just entered the Android market

MDM at ITTF 8

Implementation

iOS: built-in MDM protocol, no agent app

Mac: built-in MDM protocol, agent running in the background

Android: agent app using the OS APIs and GCM

22 May 2015

CERN MDM at HEPiX 9

Macs

12/10/2015

CERN MDM at HEPiX 10

New self-service experience

12/10/2015

User friendly interface


What’s available for CERN Macs

• Software Packages• Common Open Source (e.g. GIMP, LaTEX, OpenAFS)• Commercial (e.g. Office 2016, Parallels, Anti-Virus, …)• CERN Custom applications (e.g. CERNBox)

• Configurations• Disk encryption with File Vault• Active Directory• Exchange • Printers• EduRoam

12/10/2015


Managed iOS

12/10/2015


Personal iOS devices

• Community ‘self-help’ support• Extended with curated list of apps & settings

• https://ios.web.cern.ch/kiosk• Useful applications from the AppStore• (Public) CERN apps• Settings: certificates, mail, eduroam …• Users can add own content (moderated)

• Very similar for Android at• https://android.web.cern.ch/kiosk

12/10/2015

https://ios.web.cern.ch/kiosk

https://android.web.cern.ch/kiosk


Mobile Applications Development

• CAPPS user group to share experiences of mobile development• Play store and iTunes owners for the organisation• Own contracts and certificates for signing

• Typical applications• Outreach (e.g. CERNland, Open days)• CERN Maps, Indico, CERNBox, …• On-premise self-signing (e.g. Radiation Protection, Fire

Brigade)• Web apps (e.g. Service-Now for building repairs)

• https://indico.cern.ch/category/4852/

12/10/2015

https://indico.cern.ch/category/4852/


Professional iOS use case

• Real life example: Fire Brigade• iPads

• Shared• Predefined set

of apps and settings

• Fully managed by their admin

12/10/2015


Managed iOS• Comes with JAMF as for Mac• Not centrally managed, not intended for

Bring-Your-Own-Device• Delegated administration• For professional devices

• To be managed, device needs to be enrolled• Using the web portal• Or using USB cable (more privileges on device)

12/10/2015


Managed iOS - applications• Installation

• AppStore/In-house applications• On-demand (Self Service) or auto-install• Possible silent installation

• Update• Can be forced• Silent

• Removal• Only apps that we installed

• eBooks (not apps, but managed in similar way)• E.g. Fire brigade manuals, offline maps

12/10/2015


Managed iOS - settings• Every setting in iOS is managed using “configuration

profiles”• MDM allows to push these settings remotely

• Examples:• Restrictions, passcode• Preconfigured e-mail• WebClips (icons on desktop)• Wi-Fi (e.g. eduroam)• Single Sign-On

• ManagedAppConfig – preconfiguring installed application

12/10/2015


Managed iOS - actions• Force device to contact the server

• Normally done once a day

• Erase• Lock• Disabling/enabling roaming

12/10/2015


Managed iOS - inventory• Hardware parameters• Owner• Applications list• Configurations list

• NO reading/writing files from/to device• NO reading private data like SMSes/mails• NO geolocation

12/10/2015


VPP – Apple Volume Purchase Program

• Way for CERN IT to purchase iOS/Mac apps for users

• Needs MDM (to create user-application relation)• Needs Apple ID registered in Suisse AppStore• You can reassign the license• Single license can be used to install the app on

multiple devices• Volume discounts for 20+ licences • Please create a general ServiceNow request: https

://cern.service-now.com/service-portal/report-ticket.do?name=request&fe=Apple-Contract

12/10/2015

https://cern.service-now.com/service-portal/report-ticket.do?name=request&fe=Apple-Contract





MDM registered devices

12/10/2015


Summary• Self-Service Kiosk for Mac

• Easy discovery• Configuration scripts rather than documentation• Optional future managed service if acceptable

• Managed iOS• Locked down for work activities• Easy reset

• Apple Volume Purchase Program (VPP)• Avoid end user license ownership• Discounts for volume

12/10/2015


Links• How to join for CERN users:

• More information at http://information-technology.web.cern.ch/services/fe/howto/pilot-mac-self-service

• Mac: https://mdm.cern.ch/enroll• Managed iOS: contact IT-OIS-DS

• Paid software:https://cern.service-now.com/service-portal/report-ticket.do?name=licence-mac&fe=mac-support

• VPP:https://cern.service-now.com/service-portal/report-ticket.do?name=request&fe=Apple-Contract

• Feedback: https://social.cern.ch/community/mac-selfservice

12/10/2015

http://information-technology.web.cern.ch/services/fe/howto/pilot-mac-self-service



https://mdm.cern.ch/enroll

https://cern.service-now.com/service-portal/report-ticket.do?name=licence-mac&fe=mac-support







https://social.cern.ch/community/mac-selfservice




Questions?

12/10/2015

12/10/2015 CERN MDM at HEPiX



12/10/2015

Enrollment• First go to this site https://mdm.cern.ch/enroll

• Connect using yourCERN username and password

• Download and installthe package

• Connect to the self-service





12/10/2015

Login page

MDM at ITTF 29

CERN test criteria

22/05/2015

Functional• For each OS: iOS, Android, Mac OS

• Which versions supported for each OS family

• Ownership models: • Privately owned

• CERN owned, but used by a single user

• CERN owned, but shared

• Management models• User-managed

• Centrally-managed, but with the user in full control

• Centrally-manager with some items enforced

• Delegated administration

• Integration with volume purchasing programs and software vendors licence models• Apple VPP, including licences floating between users

• Support for concurrent licences

• Self-service app store• Updates

• For OS

• For apps

• Configurations • ex. WiFi, EduRoam, CERN certificates, data roaming

• as preferences or forced

• Hardware and software inventory• Extras

• file sharing, encryption

Technical• CERN login integration

• AD, SSO or OAUTH

• For end-users and admins

• Load balancing, high availibility• Initial deployment effort

• Basic configuration

• Integration (with AD, Network DB, etc.)

• Ease of use• For the End-user

• For the administrators

• Update cycle effort• Time before next OS versions are supported

• Upgrade procedures

Commercial•Licencing model

• Per device? Per registered user? Per FTE?

•Cost• During staged deployment• After the deployment is completed and we get CERN users on board

•Contract policy• The risk of the cost sky-rocketing after we complete the deployment

MDM at ITTF 30

Our tests

22 May 2015

• Deployment in CERN environment

• Products tested• Apple ProfileManager (iOS, Mac)• Absolute Manage (iOS, Android, Mac)• Microsoft InTune + SCCM (iOS, Android, Mac)• JAMF Casper Suite (iOS, Mac, Android)• FileWave (iOS, Android, Mac)• MobileIron (iOS, Android, Mac)• and a few more …


New self-service experiencebased on JAMF Casper Suite

12/10/2015

• MDM enables us to empower our users• Centralised point of distribution for

configurations and applications• Automated process for installing software• Specific needs for multiple computers

installation can be adapted• No mandatory packages


Add printers

12/10/2015

• Taking care of installing appropriate driver• Multiple queues configuration in one time• Proposing printers around you first,

complete list available



Microsoft Office 2016

12/10/2015

• The new Office suite for Mac is now available on self-service

• Requires Mac OS X Yosemite• New interface• New features• Dedicated presentation coming soon



Microsoft Remote Desktop

12/10/2015

• Available on AppStore via self-service• Lets you access CERN terminal services• Lets you access your Windows virtual

machines and physical hosts when connected on CERN network



Parallels Desktop V11

12/10/2015

• Makes virtual machines easy to use• More flexible than dual boot• Compatible with Filevault encrypted disk• Lets you have multiple operating systems at

the same time




12/10/2015

• A few clicks will let you encrypt your whole disk

• Should not be used with multiple operating systems

• Makes your data safer in case of stolen or lost laptop

Filevault


CERNBox

12/10/2015

• CERN file storage• Privacy respectful• Documents synchronized on your Mac and

available through your browser



OpenAFS

12/10/2015

• Lets you access AFS storage servers• Available for Mavericks and Yosemite



Miscellaneous packages

12/10/2015

• XCode• Gimp• Firefox• LaTex• Microsoft SCEP• Microsoft Lync• About this Mac



VPP

12/10/2015


VPP – purchase workflow Ask for software

through the Service Des

k

Agree on the price

and provide the budget code

Sign the TID in

EDH

Accept the VPP

invitation in the Self Service

Install the software

from

the App Stor

e

12/10/2015

Self Service for Mac and Mobiles at CERN Tim Bell, Michal Kwiatek, Maciej Muszkowski, Vincent Bippus...

Documents

Transcript of Self Service for Mac and Mobiles at CERN Tim Bell, Michal Kwiatek, Maciej Muszkowski, Vincent Bippus...