ios设备mdm的实现过程
一）配置IIS加密连接，ios系统升级7.1后已经无法使用http进行企业内部署，为了满足mdm的加密需求以及大厅的初始化安装需要进行生成自签名证书
1）配置MIME
cer application/x-x509-ca-cert
.mobileconfig application/x-apple-aspen-config
2）brew install go (如果无法link成功请运行brew prune )
go get github.com/deckarep/EasyCert
export GOPATH=$HOME/go
export PATH=$PATH:$GOPATH/bin
使用附件中的go文件替换src下的源文件，修改certName和hostName为发证单位和服务器信息(区分域名和IP地址)
go build EasyCert
easycert
3)mmc导入信任根节点myCA.cer(使用自签名的话后面IPCU中要导入根证书)
IIS导入server.pfx，设置证书，设置绑定（要重启）
下载IPCU,使用myCA.cer作为描述文件的证书，client.pfx作为mdm的验证证书
二）配置MDM
1）新建一个文件夹，然后拷贝上一步生成的server.req ,server.pfx,server.key 到该文件夹,使用server.req向developercenter请求msr证书，下载获得的证书文件mdm.cer
openssl x509 -inform der -in mdm.cer -out mdm.pem
openssl genrsa -des3 -out customerPrivateKey.pem 2048
openssl req -new -key customerPrivateKey.pem -out customer.csr -subj '/C=CN/ST=BeiJing/L=BeiJing/CN=10.18.3.33'
openssl req -inform pem -outform der -in customer.csr -out customer.der
2)从git下载mdmvendor生成plist.然后去苹果网站生成证书
python mdm_vendor_sign.py --csr customer.csr --key server.key --mdm mdm.cer
下载pem文件重命名(MDMYTHT.pem)
查看证书信息信息
openssl x509 -noout -in mdmYTHT.pem -issuer -subject -dates
将UID拷贝出来，这个是MDM中的Topic信息( com.apple.mgmt.External.e617f289-3be5-4df7-90fa-5ec8f75d8c98)
3）导出发送MDM信息的证书文件
openssl rsa -in customerPrivateKey.pem -out PlainKey.pem
cat MDMYTHT.pem PlainKey.pem > PlainCert.pem
openssl pkcs12 -export -out mdmapnscertificate.pfx -inkey PlainKey.pem -in MDMYTHT.pem
mdmapnscertificate.pfx作为推送证书在PushSharp中使用
三）iis配置接收PUT
<system.webServer>
<validation validateIntegratedModeConfiguration="false" />
<modules>
<remove name="WebDAVModule" />
<add name="ErrorLog" type="Elmah.ErrorLogModule, Elmah" preCondition="managedHandler" />
<add name="ErrorMail" type="Elmah.ErrorMailModule, Elmah" preCondition="managedHandler" />
<add name="ErrorFilter" type="Elmah.ErrorFilterModule, Elmah" preCondition="managedHandler" />
</modules>
<handlers accessPolicy="Read, Write, Execute, Script">
<remove name="StaticFile" />
<remove name="SimpleHandlerFactory-ISAPI-2.0" />
<remove name="WebDAV" />
<remove name="SimpleHandlerFactory-Integrated-4.0" />
<remove name="SimpleHandlerFactory-Integrated" />
<add name="SimpleHandlerFactory-Integrated" path="*.ashx" verb="GET,HEAD,POST,DEBUG,PUT,DELETE" type="System.Web.UI.SimpleHandlerFactory" resourceType="Unspecified" requireAccess="Write" preCondition="integratedMode" />
<add name="SimpleHandlerFactory-Integrated-4.0" path="*.ashx" verb="GET,HEAD,POST,DEBUG,PUT,DELETE" type="System.Web.UI.SimpleHandlerFactory" resourceType="Unspecified" requireAccess="Write" preCondition="integratedMode,runtimeVersionv4.0" />
<add name="SimpleHandlerFactory-ISAPI-2.0" path="*.ashx" verb="GET,HEAD,POST,DEBUG,PUT,DELETE" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll" resourceType="Unspecified" requireAccess="Script" preCondition="classicMode,runtimeVersionv2.0,bitness32" responseBufferLimit="0" />
<add name="StaticFile" path="*" verb="GET,HEAD,POST,DEBUG,PUT,DELETE" modules="StaticFileModule,DefaultDocumentModule,DirectoryListingModule" resourceType="Either" requireAccess="Read" />
<add name="FileRequest" path="*.pdf,*doc,*docx,*.pptx,*.ppt,*.pps" verb="*" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" resourceType="File" preCondition="classicMode,runtimeVersionv4.0,bitness64" />
<add name="Telerik_Web_UI_WebResource_axd" verb="*" preCondition="integratedMode" path="Telerik.Web.UI.WebResource.axd" type="Telerik.Web.UI.WebResource" />
<add name="Telerik_Web_UI_DialogHandler_aspx" verb="*" preCondition="integratedMode" path="Telerik.Web.UI.DialogHandler.aspx" type="Telerik.Web.UI.DialogHandler" />
<add name="Elmah" path="elmah.axd" verb="POST,GET,HEAD" type="Elmah.ErrorLogPageFactory, Elmah" preCondition="integratedMode" />
</handlers>
<security>
<authorization>
<remove users="*" roles="" verbs="" />
<add accessType="Allow" users="*" verbs="GET,HEAD,POST,PUT,DELETE,DEBUG" />
</authorization>
</security>
<staticContent>
<!--<mimeMap fileExtension=".gw2" mimeType="application/octet-stream"/>
<mimeMap fileExtension=".svg" mimeType="image/svg-xml"/>-->
</staticContent>
<directoryBrowse showFlags="Extension" />
<httpErrors errorMode="Detailed" />
</system.webServer>
四）获取设备Checkin的信息(如果要区分设备，需要建立页面接收用户输入的名称然后修改chekcin地址并生成mobieconfig文件供下载，使用自签名证书的话无法给改文件签名)
StreamReader stream = new StreamReader(context.Request.InputStream);
string x = stream.ReadToEnd();
string xml = HttpUtility.UrlDecode(x);
Console.WriteLine(xml);
var result = (Dictionary<string, object>)PlistCS.Plist.readPlistSource(xml);
if (result["MessageType"].ToString() == "Authenticate")
{
XbModel.XNOAEntities xnoa = new XbModel.XNOAEntities();
var udid = result["UDID"].ToString();
XbModel.MdmData mdmdata = xnoa.MdmData.FirstOrDefault(xx => xx.UDID == udid);
if (mdmdata == null)
{
mdmdata = new XbModel.MdmData();
mdmdata.UDID = result["UDID"].ToString();
mdmdata.Topic = result["Topic"].ToString();
xnoa.MdmData.Add(mdmdata);
xnoa.SaveChanges();
}
context.Response.Clear();
context.Response.ContentType = "text/xml";
context.Response.Write(APSP.Common.FileHelper.ReadFile(context.Server.MapPath("~/ForMobile/blank.plist")));
context.Response.End();
}
if (result["MessageType"].ToString() == "TokenUpdate")
{
XbModel.XNOAEntities xnoa = new XbModel.XNOAEntities();
var udid=result["UDID"].ToString();
XbModel.MdmData mdmdata = xnoa.MdmData.FirstOrDefault(xx => xx.UDID ==udid );
if (mdmdata != null)
{
mdmdata.PushMagic = result["PushMagic"].ToString();
mdmdata.Token = (byte[])result["Token"];
mdmdata.UnlockToken = (byte[])result["UnlockToken"];
xnoa.SaveChanges();
}
context.Response.Clear();
context.Response.StatusCode = 200;
context.Response.End();
}
五）推送MDM信息
var xnoa = new XNOAEntities();
var appleCert = File.ReadAllBytes(@"mdmpush.pfx");
var appleset = new ApplePushChannelSettings(true, appleCert, "******", true);
var push = new ApplePushService(appleset);
push.OnNotificationFailed += new PushSharp.Core.NotificationFailedDelegate(push_OnNotificationFailed);
push.OnNotificationSent += (sender, notification1) => Console.WriteLine("NOTIFICATION Send: " + ((AppleNotification)notification1).DeviceToken);
push.OnNotificationRequeue += (sender, e) => Console.WriteLine("REQUEUE: " + ((AppleNotification)e.Notification).Identifier);
push.OnServiceException += new PushSharp.Core.ServiceExceptionDelegate(push_OnServiceException);
foreach (var mdmcommand in xnoa.MdmCommand.Where(x => x.CommandStatus == "-1"))
{
String pushMagicString = mdmcommand.PushMagic;
String token = mdmcommand.Token;// BitConverter.ToString(mdmdata.Token).Replace("-", string.Empty);
Console.WriteLine("Device Token length is: " + token.Length);
Console.WriteLine("DeviceToken is: " + token);
Console.WriteLine("PushMagic is: " + pushMagicString);
var notification = new AppleNotification(token, new AppleNotificationPayload()).WithCustomItem("mdm", mdmcommand.PushMagic);
Console.WriteLine(notification.ToString());
push.QueueNotification(notification);
}
Console.WriteLine("Waiting for Queue to Finish...");
//Stop and wait for the queues to drains
push.Stop(true);
Console.WriteLine("Queue Finished, press return to exit...");
