ios设备mdm的实现过程

 一）配置IIS加密连接，ios系统升级7.1后已经无法使用http进行企业内部署，为了满足mdm的加密需求以及大厅的初始化安装需要进行生成自签名证书

1）配置MIME
cer application/x-x509-ca-cert
.mobileconfig application/x-apple-aspen-config

2）brew install go (如果无法link成功请运行brew prune )
go get github.com/deckarep/EasyCert
export GOPATH=$HOME/go
export PATH=$PATH:$GOPATH/bin
使用附件中的go文件替换src下的源文件，修改certName和hostName为发证单位和服务器信息(区分域名和IP地址)
go build EasyCert
easycert

3)mmc导入信任根节点myCA.cer(使用自签名的话后面IPCU中要导入根证书)
IIS导入server.pfx，设置证书，设置绑定（要重启）
下载IPCU,使用myCA.cer作为描述文件的证书，client.pfx作为mdm的验证证书

二）配置MDM

1）新建一个文件夹，然后拷贝上一步生成的server.req ,server.pfx,server.key 到该文件夹,使用server.req向developercenter请求msr证书，下载获得的证书文件mdm.cer

openssl x509 -inform der -in mdm.cer -out mdm.pem

openssl genrsa -des3 -out customerPrivateKey.pem 2048
openssl req -new -key customerPrivateKey.pem -out customer.csr -subj '/C=CN/ST=BeiJing/L=BeiJing/CN=10.18.3.33'
openssl req -inform pem -outform der -in customer.csr -out customer.der

2)从git下载mdmvendor生成plist.然后去苹果网站生成证书

python mdm_vendor_sign.py --csr customer.csr --key server.key --mdm mdm.cer

下载pem文件重命名(MDMYTHT.pem)
查看证书信息信息
openssl x509 -noout -in mdmYTHT.pem -issuer -subject -dates
将UID拷贝出来，这个是MDM中的Topic信息( com.apple.mgmt.External.e617f289-3be5-4df7-90fa-5ec8f75d8c98)

3）导出发送MDM信息的证书文件

openssl rsa -in customerPrivateKey.pem -out PlainKey.pem
cat MDMYTHT.pem PlainKey.pem > PlainCert.pem
openssl pkcs12 -export -out mdmapnscertificate.pfx -inkey PlainKey.pem -in MDMYTHT.pem

mdmapnscertificate.pfx作为推送证书在PushSharp中使用

 

三）iis配置接收PUT

<system.webServer>

		<validation validateIntegratedModeConfiguration="false" />

		<modules>

      <remove name="WebDAVModule" />

      <add name="ErrorLog" type="Elmah.ErrorLogModule, Elmah" preCondition="managedHandler" />

			<add name="ErrorMail" type="Elmah.ErrorMailModule, Elmah" preCondition="managedHandler" />

			<add name="ErrorFilter" type="Elmah.ErrorFilterModule, Elmah" preCondition="managedHandler" />

		</modules>

    <handlers accessPolicy="Read, Write, Execute, Script">

      <remove name="StaticFile" />

      <remove name="SimpleHandlerFactory-ISAPI-2.0" />

      <remove name="WebDAV" />

      <remove name="SimpleHandlerFactory-Integrated-4.0" />

      <remove name="SimpleHandlerFactory-Integrated" />

      <add name="SimpleHandlerFactory-Integrated" path="*.ashx" verb="GET,HEAD,POST,DEBUG,PUT,DELETE" type="System.Web.UI.SimpleHandlerFactory" resourceType="Unspecified" requireAccess="Write" preCondition="integratedMode" />

      <add name="SimpleHandlerFactory-Integrated-4.0" path="*.ashx" verb="GET,HEAD,POST,DEBUG,PUT,DELETE" type="System.Web.UI.SimpleHandlerFactory" resourceType="Unspecified" requireAccess="Write" preCondition="integratedMode,runtimeVersionv4.0" />

      <add name="SimpleHandlerFactory-ISAPI-2.0" path="*.ashx" verb="GET,HEAD,POST,DEBUG,PUT,DELETE" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll" resourceType="Unspecified" requireAccess="Script" preCondition="classicMode,runtimeVersionv2.0,bitness32" responseBufferLimit="0" />

      <add name="StaticFile" path="*" verb="GET,HEAD,POST,DEBUG,PUT,DELETE" modules="StaticFileModule,DefaultDocumentModule,DirectoryListingModule" resourceType="Either" requireAccess="Read" />

      <add name="FileRequest" path="*.pdf,*doc,*docx,*.pptx,*.ppt,*.pps" verb="*" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" resourceType="File" preCondition="classicMode,runtimeVersionv4.0,bitness64" />

			<add name="Telerik_Web_UI_WebResource_axd" verb="*" preCondition="integratedMode" path="Telerik.Web.UI.WebResource.axd" type="Telerik.Web.UI.WebResource" />

			<add name="Telerik_Web_UI_DialogHandler_aspx" verb="*" preCondition="integratedMode" path="Telerik.Web.UI.DialogHandler.aspx" type="Telerik.Web.UI.DialogHandler" />

			<add name="Elmah" path="elmah.axd" verb="POST,GET,HEAD" type="Elmah.ErrorLogPageFactory, Elmah" preCondition="integratedMode" />

		</handlers>

    <security>

      <authorization>

        <remove users="*" roles="" verbs="" />

        <add accessType="Allow" users="*" verbs="GET,HEAD,POST,PUT,DELETE,DEBUG" />

      </authorization>

    </security>

		<staticContent>

			<!--<mimeMap fileExtension=".gw2" mimeType="application/octet-stream"/>

      <mimeMap fileExtension=".svg" mimeType="image/svg-xml"/>-->

		</staticContent>

		<directoryBrowse showFlags="Extension" />

        <httpErrors errorMode="Detailed" />

	</system.webServer>

	

　　

四）获取设备Checkin的信息(如果要区分设备，需要建立页面接收用户输入的名称然后修改chekcin地址并生成mobieconfig文件供下载，使用自签名证书的话无法给改文件签名)

 StreamReader stream = new StreamReader(context.Request.InputStream);

        string x = stream.ReadToEnd();

        string xml = HttpUtility.UrlDecode(x);

        Console.WriteLine(xml);

        var result = (Dictionary<string, object>)PlistCS.Plist.readPlistSource(xml);

        if (result["MessageType"].ToString() == "Authenticate")

        {

            XbModel.XNOAEntities xnoa = new XbModel.XNOAEntities();

            var udid = result["UDID"].ToString();

            XbModel.MdmData mdmdata = xnoa.MdmData.FirstOrDefault(xx => xx.UDID == udid);

            if (mdmdata == null)

            {

                mdmdata = new XbModel.MdmData();

                mdmdata.UDID = result["UDID"].ToString();

                mdmdata.Topic = result["Topic"].ToString();

                xnoa.MdmData.Add(mdmdata);

                xnoa.SaveChanges();

            }

            context.Response.Clear();

            context.Response.ContentType = "text/xml";

            context.Response.Write(APSP.Common.FileHelper.ReadFile(context.Server.MapPath("~/ForMobile/blank.plist")));

            context.Response.End();

        }

        if (result["MessageType"].ToString() == "TokenUpdate")

        {

            XbModel.XNOAEntities xnoa = new XbModel.XNOAEntities();

            var udid=result["UDID"].ToString();

            XbModel.MdmData mdmdata = xnoa.MdmData.FirstOrDefault(xx => xx.UDID ==udid );

            if (mdmdata != null)

            {

                mdmdata.PushMagic = result["PushMagic"].ToString();

                mdmdata.Token = (byte[])result["Token"];

                mdmdata.UnlockToken = (byte[])result["UnlockToken"];

                xnoa.SaveChanges();

            }

            context.Response.Clear();

            context.Response.StatusCode = 200;

            context.Response.End();

        } 

　　

 

五）推送MDM信息

var xnoa = new XNOAEntities();



            var appleCert = File.ReadAllBytes(@"mdmpush.pfx");



            var appleset = new ApplePushChannelSettings(true, appleCert, "******", true);



            var push = new ApplePushService(appleset);





            push.OnNotificationFailed += new PushSharp.Core.NotificationFailedDelegate(push_OnNotificationFailed);

            push.OnNotificationSent += (sender, notification1) => Console.WriteLine("NOTIFICATION Send: " + ((AppleNotification)notification1).DeviceToken);

            push.OnNotificationRequeue += (sender, e) => Console.WriteLine("REQUEUE: " + ((AppleNotification)e.Notification).Identifier);

            push.OnServiceException += new PushSharp.Core.ServiceExceptionDelegate(push_OnServiceException);

            foreach (var mdmcommand in xnoa.MdmCommand.Where(x => x.CommandStatus == "-1"))

            {

                String pushMagicString = mdmcommand.PushMagic;



                String token = mdmcommand.Token;// BitConverter.ToString(mdmdata.Token).Replace("-", string.Empty);

                Console.WriteLine("Device Token length is: " + token.Length);

                Console.WriteLine("DeviceToken is: " + token);

                Console.WriteLine("PushMagic is: " + pushMagicString);

                var notification = new AppleNotification(token, new AppleNotificationPayload()).WithCustomItem("mdm", mdmcommand.PushMagic);

                Console.WriteLine(notification.ToString());

                push.QueueNotification(notification);



            }







            Console.WriteLine("Waiting for Queue to Finish...");



            //Stop and wait for the queues to drains

            push.Stop(true);



            Console.WriteLine("Queue Finished, press return to exit...");