User manual APPLE IPHONE OS ENTREPRISE DELOYMENT

[. . . ] iPhone OS Enterprise Deployment Guide Second Edition, for Version 3. 1 or later K Apple Inc. © 2009 Apple Inc. All rights reserved. This manual may not be copied, in whole or in part, without the written consent of Apple. Use of the "keyboard" Apple logo (Option-Shift-K) for commercial purposes without the prior written consent of Apple may constitute trademark infringement and unfair competition in violation of federal and state laws. Every effort has been made to ensure that the information in this manual is accurate. [. . . ] To undo an inadvertent change to these settings, delete the profile from the device. Apple recommends that you define APN settings in a configuration profile separate from other enterprise settings, because profiles that specify APN information must be signed by your cell service provider. iPhone supports APN user names of up to 20 characters, and passwords of up to 32 characters. Editing Configuration Profiles In iPhone Configuration Utility, select a profile in the Configuration Profiles list, and then use the payload list and editing panes to make changes. You can also import a profile by choosing File > Add to Library and then selecting a . mobileconfig file. If the settings panes aren't visible, choose View > Show Detail. 40 Chapter 2 Creating and Deploying Configuration Profiles The Identifier field in the General payload is used by the device to determine whether a profile is new, or an update to an existing profile. If you want the updated profile to replace one that users have already installed, don't change the Identifier. Installing Provisioning Profiles and Applications iPhone Configuration Utility can install applications and distribution provisioning profiles on devices attached to the computer. For details, see Chapter 5, "Deploying iPhone Applications, " on page 63. Installing Configuration Profiles After you've created a profile, you can connect a device and install the profile using iPhone Configuration Utility. Alternatively, you can distribute the profile to users by email, or by posting it to a website. When users use their device to open an email message or download the profile from the web, they're prompted to start the installation process. Installing Configuration Profiles Using iPhone Configuration Utility You can install configuration profiles directly on a device that has been updated to iPhone OS 3. 0 or later and is attached to your computer. You can also use iPhone Configuration Utility to remove previously installed profiles. To install a configuration profile: 1 Connect the device to your computer using a USB cable. After a moment, the device appears in the Devices list in iPhone Configuration Utility. 3 Select a configuration profile from the list, and then click Install. When you install directly onto a device using USB, the configuration profile is automatically signed and encrypted before being transferred to the device. Distributing Configuration Profiles by Email You can distribute configuration profiles using email. Users install the profile by receiving the message on their device, then tapping the attachment to install it. To email a configuration profile: 1 Click the Share button in the iPhone Configuration Utility toolbar. In the dialog that appears, select a security option: a None: A plain text . mobileconfig file is created. Some content in the file is obfuscated to prevent casual snooping if the file is examined. Chapter 2 Creating and Deploying Configuration Profiles 41 b Sign Configuration Profile: The . mobileconfig file is signed and won't be installed by a device if it's altered. Some fields are obfuscated to prevent casual snooping if the file is examined. Once installed, the profile can only be updated by a profile that has the same identifier and is signed by the same copy of iPhone Configuration Utility. c Sign and Encrypt Profile: Signs the profile so it cannot be altered, and encrypts all of the contents so the profile cannot be examined and can only be installed on a specific device. Separate . mobileconfig files will be created for each of the devices you select from the Devices list. [. . . ] Dynamic trust (the certificate dialogue) is disabled if this property is specified, unless TLSAllowTrustExceptions is also specified with the value true (see below). This is the list of server certificate common names that will be accepted. If a server presents a certificate that isn't in this list, it won't be trusted. Used alone or in combination with TLSTrustedCertificates, the property allows someone to carefully craft which certificates to trust for the given network, and avoid dynamically trusted certificates. [. . . ]