Prerequisites

The Reflex Android application supports the "managed configuration" feature provided by Android Enterprise.
It only works for terminals running Android 6 or later.

Your MDM tool will therefore need to be able to deploy “managed applications” in accordance with Android Enterprise rules.

Configuration

Each tool is different, however, here we will look at a configuration defined in Microsoft Intune.

1. Open Microsoft Intune.
2. Search for the Reflex Web application in the Google Play Store, which can be accessed from the MDM tool: https://play.google.com/store/apps/details?id=hardis.com.wagonandroid&hl=en
3. Make the application available.

1. In the application properties, assign the application to the relevant users or terminals.
2. Return to the main menu and select "App configuration policies".
3. Create a "managed devices" policy and assign it to the Reflex Web application.

You then need to input the parameters exposed by Reflex Web.
Depending on your MDM tool's capabilities, you can choose between two configuration methods:

Reflex Web parameters

Assisted configuration

Microsoft Intune provides a "Designer" configuration but unfortunately it does not support the "bundleArray" parameter lists exposed by Reflex Web. You will therefore need to use a json file for the configuration.

You will find the description of the parameters further down on this page.

Configuration via json file

The json file consists of lists of keys to which a value must be assigned.

Extract from the json file:

{
"kind": "androidenterprise#managedConfiguration",
"productId": "app:hardis.com.wagonandroid_beta",
"managedProperty": [
{ "key": "configurations",
"valueBundleArray": [
{ "managedProperty": [
{ "key": "pref_name", "valueString": "Test" },
{ "key": "pref_icon", "valueString": "favicon.ico" },
{ "key": "pref_cat_connection",
"valueBundle": {
"managedProperty": [
{ "key": "pref_url", "valueString": " https://10.209.5.47:443/reflex " },
{ "key": "pref_environment", "valueString": "formation" },
{ "key": "pref_application_profile", "valueString": "RFXPGM=HEPWAG&RFXFOR=01" },
{ "key": "pref_url_parameters", "valueString": "" },
{ "key": "pref_desktop", "valueString": "android" },
{ "key": "pref_keep_alive", "valueInteger": 10 }
]

...

You can define several configurations (parameter groups) to enable access to your test environment or production environment, for example, by duplicating the data block, as shown below.

Example of a json file with two parameter groups:

{
"kind": "androidenterprise#managedConfiguration",
"productId": "app:hardis.com.wagonandroid_beta",
"managedProperty": [
{ "key": "configurations",
"valueBundleArray": [
{ "managedProperty": [
{ "key": "pref_name", "valueString": "Test" },
...
]
},
{ "managedProperty": [
{ "key": "pref_name", "valueString": "Production" },
...

Warnings

It is up to the MDM tool to push updates from the Reflex Android application to the terminals.

The parameters set by the MDM tool can no longer be modified by the user. If you want users to be able to decide this, the MDM tool should not populate the parameter.

Parameters modified by the MDM tool will be taken into account when the Reflex Android application is started.

Desktop shortcuts that enable users to access each Reflex environment directly cannot be deployed automatically. These will need to be created by the user manually using the environment menu in Reflex Apk.

The Reflex Apk variant that can be downloaded from Google Play Store has the following restrictions:

• Auto-updating from the Reflex server is not permitted.
• Accessing the file system is not permitted. It is therefore not possible to inject parameters via files.

Obtaining Reflex Web Android

Download the .apk file of the latest version from the following URL: https://nexus.hardis-group.com/#browse/browse:adelia-isv:hardis%2Fcom%2Fwagonandroid%2Freflexweb-legacy

This is the Legacy variant, which is the only one that can access configuration files.

Mono-environment configuration

Use this when you would like to force the configuration so that the terminal only accesses one Reflex environment, such as production:

• Copy the REFLEX_HOME/conf/android*.properties file from your Reflex server to /Hardis/Reflex/Conf/reflexWeb.properties on the terminal.

• Then edit the reflexWeb.properties file by adding the following lines to the start of the file:

url=connection-url/reflex

config_key=key_name

The connection_url is made up of the connection mode (http or https), followed by the name of the server or load balancer, and finally the port number, if needed.

values_of_url_parameters contains the value of the "url_parameters variable" found at the start of the .properties file you just created.

config_key corresponds to the value found on the reflex/updater page (URL in the installation report) or in the conf/storeConfig.properties file.

Click here to download an example of file to put in /Hardis/Reflex/Conf/.

Multi-environment configuration

Use this when you would like to authorise the terminal to access multiple Reflex environments, such as production and test:

Create the /sdcard/Hardis/Reflex/Conf/configurations.xml file (external storage). This file contains the list of configurations.

Example of the content in this file:

<?xml version="1.0" encoding="UTF-8"?>

<configurations>

<configuration><name>Tests</name>

<url>http://<web server name>:port /reflex?RFXENV=<environment_name>&amp;RFXPGM=HEPWAG&amp;RFXFOR=01</url>

<key>1_Portrait</key>

<icon>favicon.ico</icon>

</configuration>

</configurations>

A configuration will need to be created for:

• each Reflex environment,

• each terminal orientation (portrait/landscape),

• each application resolution (320x240, 640x480, 800x600).

Loading the configuration parameters

Once it finds the configuration URL, the application connects to the Reflex server and searches for the parameters to be downloaded. For example, it

• searches for the Key field (value of "1_Portrait" in our example above) in the REFLEX_HOME/conf/storeConfig.properties file.:Example of a storeConfig.properties file:

hardis.com.wagonandroid=[URL]url/androidApk;[URL]url/androidEmulatorConfigMobilePortrait

hardis.com.wagonandroid\:1_Portrait=[URL]url/androidApk;[URL]url/androidEmulatorConfigMobilePortrait

hardis.com.wagonandroid\:2_Landscape=[URL]url/androidApk;[URL]url/androidEmulatorConfigMobileLandscape

• The REFLEX_HOME/conf/androidEmulatorConfigMobilePortrait.propertiesserver file is then downloaded.
  This is a commented file containing explanations of the possible parameter values.

Taking updates into account

Updating Reflex Apk

If the disable_auto_update parameter is set to "false", when Reflex Apk starts for the first time each day, it automatically checks for a more recent update or for changes to the parameters file on the Reflex server.

It is possible to manually request an update using the Update menu in Reflex Apk.

Updating parameters

Parameters are managed as follows:

Parameters can be modified by the user from the Reflex Apk parameters menu and are taken into account immediately. If they are populated in the file, they will be overwritten by the parameter values in the file the next time it is read.

Configurations with certificates

Https specification - Auto-signed certificate or company certificate

It is possible to automate the import of auto-signed certificates in the Reflex application on the Android terminal. This does not apply to paid certificates as they already take this process into account.

Creating the keystore

The Keystore can only be created on a Reflex server that has a web role (Java is required).

Create the "keystore" using the following command (cmd or Linux):

keytool -importcert -v -trustcacerts ?file certificatename -alias certificatealias -keystore storename -provider

org.bouncycastle.jce.provider.BouncyCastleProvider -providerpath bcprovjar -storetype BKS -storepass storepass -noprompt

certificatename: Name of the certificate file (with path if needed)

certificatealias: Alias to be assigned to this certificate.

storename: Name of the keystore file to be generated/modified.

bcprovjar: Path to the "bcprov" jar file (provided in Reflex for the web and processing roles. It is located in the $REFLEX_HOME/product/java/reflexcloud/WEB-INF/lib/ folder and its name starts with bcprov-jdk.

For example: /hardis/reflex/product/java/reflexcloud/WEB-INF/lib/bcprov-jdk15on-1.60.jar)

storepass: Keystore password

Modifying the reflexWeb.properties file

The following lines must be added to the reflexWeb.properties file:

# created truststore

ssl_trust_store=MYSRVTRUSTSTORE.BKS

# Password to access to local truststore (default changeit)

ssl_trust_store_password=STOREPASS_NAME

ssl_trust_store corresponds to the name of the "keystore" that you have already created or will create after this step.

ssl_trust_store_password corresponds to the "storepass" password that you have already created or will create after this step.

Then copy the reflexWeb.properties file and the keystore to the following folder on the terminal:  /Hardis/Reflex/Conf/

Also add the following three lines to the start of the file:

ssl_private_store=true

ssl_allow_all_hosts=true

disable_auto_update=false

ssl_private_store: If this option is checked, secure (SSL) connections will use the application’s certificates instead of the system's certificates (True: Auto-signed; False: Paid).

ssl_allow_all_hosts: If this option is selected, the server name will not be verified during SSL(True: Auto-signed; False: Paid).

disable_auto_update: Deactivates automatic updates and configuration.
It should be set to "False" if you want Reflex to perform the update