App Wrapping Requirements

View the supported platforms, bit versions, architectures, console versions, and environments for wrapping apps. Use supported systems to ensure that the solution integrates with your mobile deployment. These requirements also list what app wrapping scenarios and components are not supported so review for caveats.

General Requirements

Supported Platforms and Bit Versions

The application that you wrap must be compatible with the following components. If an application was built with an Omnissa Workspace ONE SDK older than the version listed, it is not compatible with app wrapping.

Supported Deployments and Requirements

App wrapping is available for the following deployments, using the SaaS-Hosted app wrapping engine to wrap internal applications. The feature does not wrap public or purchased applications.

Store Apps Do Not Wrap

You cannot wrap applications from app stores, even if the APK or IPA comes from the vendor directly. Contact vendors to see if they can incorporate the Workspace ONE SDK and AppConfig into their applications to address enterprise requirements.

Standard Processes

App wrapping works with Android and iOS applications developed using standard Android and iOS SDK processes.

Standard and C/C++ Libraries

App Wrapping works with applications using standard Android and iOS Java/Objective-C layer libraries. If an application uses low-level C/C++ libraries, then some app wrapping features might not work or the application might not wrap properly.

Tampering Protection

Remove tampering protection from the application you want to wrap. App Wrapping involves altering the application so app wrapping cannot work with this protection enabled.

Supported Settings and Policies Options

Assign an App Wrapping Profile to apply Workspace ONE SDK funtionality to a wrapped application. Configure the profile in Resources > Profiles & Baselines > SDK Profiles > Add Profile > App Wrapping Profile.

The table lists the default settings supported by App Wrapping. For information about supported features for Workspace ONE UEM applications, see the content for that application.

Visual Studio Enterprise Edition

To package applications for installation, use Visual Studio Enterprise Edition. You must select to Enable Bundle Assemblies into Native Code or the app wrapping engine cannot wrap the application.

Android Requirements

Supported Android Components

• Build the app with the Android API level 21 or later. Older versions of the Android API do not build applications that are compatible with app wrapping.
• Use the Android GMS library v16.0.0 for Google Play Services because it is the only supported version.
• Use SQLCipher for Android 4.2 or later.

Android Apps Built with Crosswalk Project Libraries Do Not Wrap

Crosswalk on Android provides a packaging tool and a Java wrapper layer. They can bundle Web applications into the Android Web app APKs. This Java wrapper layer calls Crosswalk runtime, and Crosswalk runtime is a full-featured Web engine mostly written in C/C++. Android platforms do not package C/C++ code into SMALI files, and the app wrapping solution cannot modify and wrap the C/C++ libraries and code.

Android Enterprise Support

• We support app wrapping in Android Enterprise Work Managed (Device Owner) mode.
• We do not support app wrapping for Android Enterprise Work Profile (Profile Owner) mode because of internal app constraints. Our app wrapping engine uses internal apps, and we cannot directly publish these apps in Managed Google Play in a Work Profile.

Xamarin Requirements for Android

Workspace ONE UEM is certified to wrap applications built using Xamarin, but you must override all methods by the super class.

To override method() from the super class, call super.method() in the method(). This process requires the addition of code to all applicable classes. You must also use Visual Studio Enterprise Edition to package the application.

Code to Add

```
@Override
Public void onCreate(Bundle param ){
Super.onCreate(param);        // make sure you have this call in order for App Wrapping to be supported with Xamarin apps
}
```

Add code to all classes extending to the listed classes.

• Application.class
• Activity.class
• AppCompatActivity.clas,
• AccountAuthenticatorActivity.class
• ExpandableListActivity.class
• FragmentActivity.class
• ListActivity.class
• NativeActivity.class
• LauncherActivity.class
• PreferenceActivity.class
• Webview.class
• WebviewClient.class

Android Bit Architecture Native Files

The Workspace ONE SDK and app wrapping do not support 64-bit architecture native files for Android. These files, when wrapped, do not run and display no screens.

Android Method Limits and Multidex Support

The compiler that app wrapping uses has a limit of 62 thousand methods for applications. With the support of multidex, you can now create larger APKs with each DEX limited to 65 thousand methods. However, app wrapping must inject functionality into the application by adding methods to the primary DEX. To ensure that wrapping completes, ensure that the primary DEX has 58 thousand methods or less. This method count gives the wrapping system room to inject methods into the primary DEX.

Find information on how to limit methods on the Web from the listed site as of November 2018, https://developer.android.com/studio/build/shrink-code.html.

Example: Method Limiting in the Gradle File

```
afterEvaluate {
    tasks.matching {
        it.name.startsWith('dex')
    }.each { dx ->
        if (dx.additionalParameters == null) {
            dx.additionalParameters = []
        }
        dx.additionalParameters += "--set-max-idx-number=58000"
    }
}
```

Android Apps and the Version of the SDK That Wraps Them

The version of the Workspace ONE SDK the system wraps your app with depends on whether your app uses AndroidX or an older support library. If you want the latest Workspace ONE UEM features, the app must use AndroidX.

• AndroidX - The app wrapping engine wraps the app with the latest version of the Workspace ONE SDK.
• Older support library - The app wrapping engine wraps the app with the Workspace ONE SDK for Android v19.7.

Native Libraries in Android Apps

App Wrapping cannot fully support native libraries inside Android applications because the wrapping engine cannot interpret the processes these libraries invoke. Applications might wrap but these applications might not behave as expected after you install them on devices. Problems can arise with core functionalities, wrapping restrictions, tunneling, encryption, single sign-on, and other application processes.

Android Library Dependencies

Ensure that the listed libraries are not obfuscated in the original version of the application or wrapping fails.

• com.google.gson:gson:2.4
• com.google.guava:guava:20.0
• com.google.zxing:zxing:3.2.1
• com.sqlcipher:3.5.9
• com.squareup.okhttp3:okhttp:3.14.2
• libcrypto.1.0.2.so
• libencjni.so
• libf5apptun.so
• libfips_main.so
• libiocipher.so
• libkerberosapp.so
• libsqlcipher.so
• libssl.1.0.2.so
• org.apache.commons:codec:1.7
• org.apache.commons:io:2.4
• org.apache.commons:codec:1.7
• org.apache.commons:io:2.4"
• org.apache.commons:lang3:3.1

Enabling and Deactivating Encryption for Android Wrapped Apps

If you want to use encryption in wrapped Android apps, ensure that no data is read unless you programmatically wrote it to be read. This caveat includes database and file systems.

For those wrapped Android apps that do not use encryption, ensure to deactivate encryption in the Workspace ONE UEM console. If you do not deactivate encryption in the console, the wrapped apps might crash.

iOS Requirements

iOS App Wrapping Requirements

• App wrapping supports wrapping iOS apps built with Xcode 10 or later.
• If @executable_path/Frameworks is missing from the Xcode build settings in LD_RUNPATH_SEARCH_PATHS of the build target, add it to Xcode build settings. If you do not add this and you are using the most current wrapping engine, the app crashes after wrapping.
• If your iOS app is Swift based, use Swift 5.0 or later.
• iOS Developer Enterprise Account - Use this account to get Xcode used to compile the application as part of the wrapping process. Go to https://developer.apple.com/xcode/ for information. Use this account type to develop iOS applications for use internally and not to deploy to an app store. To develop internal applications, ensure to get auxiliary files for enterprise (internal) distribution and not app store deployment.
• Mobile Provisioning Profile - Get this file from Apple's Developer Portal. Get this profile for enterprise use, because it is specific to your application and to the Code Signing Certificate. The bundle ID of the provisioning profile matches the bundle ID of the IPA file.
• Code Signing Certificate - Get this file from Apple's Developer Portal. Get this file for enterprise use and not app store distribution, and use it to sign the wrapped application.
• Sign the iOS Binary - Sign the application with the provisioning profile and the signing certificate before wrapping the application.

Using iOS Apps Developed in Swift

If your iOS app is Swift based, use Swift 5.0 or later.

Entitlements for iOS Apps

Enable the keychain-access-group's permission in the entitlements of iOS applications before wrapping. This permission allows Workspace ONE UEM to store Secure Channel Certificates in the iOS keychain of the application because Workspace ONE UEM uses Secure Channel Certificates to communicate.

If you do not enable this permission, Workspace ONE UEM automatically enables the permission. If your mobile provisioning profile does not have the keychain-access-group listed in the entitlements, you might have a wrapping issue . The wrapped application might not behave as expected when installed on devices.

Mobile Provisioning Profile for iOS Apps

Ensure you use a mobile provisioning profile that matches the bundle ID of the application. Wildcard provisioning profiles might not allow the use of certain entitlements, like iCloud.

Synchronous Calls and iOS Apps

Avoid synchronous calls, if possible. Instead, consider using asynchronous methods or putting synchronous calls in their own threads. Synchronous logic can negatively impact the ability of the feature to intercept preventable calls.

Integrated Authentication Code Requirements for iOS (Swift) Apps

For integrated authentication to work for apps that use the URLSession class, use the sharedSession API to create the session.

No Support for UIWindowSceneDelegate in iOS Apps

App wrapping does not support wrapping iOS apps that use Windows Scenes (UIWindowSceneDelegate).