What you configure on MobileIron Cloud to use derived credentials
The following list shows the high-level configuration tasks necessary on MobileIron Cloud to support derived credentials for AppConnect.
Figure 1. High-level Configuration Tasks on Admin Portal
The following table provides more details. The table:
-
Describes each configuration task related to derived credentials that is necessary on MobileIron Cloud.
-
Indicates to which derived credential providers and device platform (iOS, Android AppConnect) the task applies.
-
Provides a cross-reference to the detailed steps for each task.
| NOTE: | The task list assumes that you want device users to register MobileIron Go using a registration PIN rather than with a user ID and password, since typically, device users who use smart cards do not have passwords. However, using a registration PIN is a requirement only with Entrust derived credentials. For other derived credential providers, it is not a requirement, and therefore the related tasks are optional. |
|
Task |
Notes |
||||||||||||||||||
Configuring certificate authentication to the MobileIron Cloud Self-Service Portal |
Allowing certificate authentication includes uploading to Cloud a valid issuing (CA) certificate or a valid supporting certificate chain. Entrust This task is required for Entrust derived credentials, because it is a prerequisite for configuring Cloud to use the Entrust IdentityGuard Self-Service Module (SSM) URL. All other derived credentials providers Although not strictly required for other derived credential providers, device users who use smart cards typically do not have passwords. Therefore, if you want them to be able to access the self-service user portal to, for example, generate a registration PIN, this step is required.
|
||||||||||||||||||
|
Entrust MobileIron Cloud uses this URL to get derived credentials from Entrust. The device user will use the PIV-D Manager app for iOS or the PIV-D Manager app for Android to activate the derived credential on a device. |
||||||||||||||||||
|
Entrust This task is required for Entrust derived credentials because device users need a registration PIN to request an Entrust derived credential. All other derived credentials providers Although not strictly required for other derived credential providers, device users who use smart cards typically do not have passwords. Therefore, if you want them to be register MobileIron Go using a one-time registration PIN, this step is required. |
||||||||||||||||||
|
All derived credential providers The activated derived credentials are stored in MobileIron Go for iOS or Secure Apps Manager for Android. Each of these components provides an identity certificate from the derived credential to the AppConnect app. You configure an AppConnect app to use derived credentials by referencing an Identity Certificate Configuration that specifies using derived credentials. The reference to the Identity Certificate Configuration is in the app’s AppConnect Certificate Configuration. You configure an Identity Certificate Configuration for one of these purposes, as needed: authentication, signing, or encryption. |
||||||||||||||||||
|
All derived credential providers iOS only You use the App Catalog web clip on devices to distribute apps from the MobileIron Cloud App Catalog. |
||||||||||||||||||
|
All derived credential providers Configuring AppConnect allows device users to use AppConnect apps, including the derived credential app. |
||||||||||||||||||
Adding the PIV-D Manager app for iOS to the App Catalog Adding a third-party iOS derived credential app to the App Catalog |
Entrust on Android Add the PIV-D Manager app for Android to the App Catalog on MobileIron Cloud. Entrust and DISA Purebred on iOS Add the PIV-D Manager app for iOS to the App Catalog on MobileIron Cloud Other derived credential providers on iOS Add the appropriate third-party derived credential app to the App Catalog on MobileIron Cloud. |
||||||||||||||||||
Adding the PIV-D Manager app for iOS to the App Catalog |
iOS only Configure the PIV-D Manager app for iOS as follows: Entrust
DISA Purebred
For both Entrust and DISA Purebred
|
||||||||||||||||||
|
Entrust Android only Configure the PIV-D Manager app for Android to:
|
||||||||||||||||||
Adding a third-party iOS derived credential app to the App Catalog |
Derived credential providers other than Entrust or DISA Purebred Derived credential providers other than Entrust or DISA Purebred iOS only You configure an iOS third-party derived credential app to receive app-specific settings from MobileIron Cloud, as defined by the app vendor or developer. |
||||||||||||||||||
These AppConnect apps can include Web@Work, Docs@Work, Email +, and in-house AppConnect apps. Adding Web@Work for iOS to the App Catalog Adding Web@Work for Android to the App Catalog Adding Docs@Work for iOS to the App Catalog Adding Docs@Work for Android to the App Catalog Setting up Email+ to use derived credentials |
All derived credential providers When you add each AppConnect app that uses derived credentials to the App Catalog, you specify in its AppConnect Certificate Configuration which derived credential identity certificate to use. |