Configure Akamai CDN to communicate with the Workspace ONE origin server and your end-user devices to set up various download properties and fulfill your business needs by working with your Akamai representative. For more information, see Akamai product documentation at [https://www.akamai.com](https://www.akamai.com).
Generic Requirements
- You must have the Akamai Download Delivery solution account.
- You must create a secret key (SHA256 Hash Key) which is used while running the CDN installer and for the Akamai account for Edge Server Identification.
Workspace ONE UEM and Akamai Integration Architecture
The Workspace ONE UEM and Akamai Integration Workflow highlight the communication and interaction between Workspace ONE UEM and Akamai. Workspace ONE UEM and Akamai Integration support allowlisting of Akamai Edge Server IP Address. If your end-user devices are a part of a network that allows connections to only servers whose IP addresses are allowlisted, then the integration can be implemented with variation in Akamai configuration.
Workspace ONE UEM and Akamai Integration Workflow Components
- Workspace ONE Origin Server: The Workspace ONE Origin Server is the file server that is configured for storage of all files that will then be cached within the Akamai CDN.
- Content Server Domain: The content server domain is the domain mapping to the configured Akamai Edge Server using the CNAME DNS plus *.edgekey.net.
Akamai Integration Workflow Diagram
| Workflow Number | Description |
|---|---|
| 1 | Admin uploads apps to the Workspace ONE UEM console. |
| 2 | Adds the application to the AirWatch Database or the File Storage Server. |
| 3 | Copies the application files using the configured UNC path and credentials. |
| 4 | Publish the application to the end-user devices. |
| 5 | Generate the app download URL containing HMAC Token, which is valid for 24hrs, using the salt/encryption key with SHA256 algorithm. |
| 6 | Send the generated content download URL to the device. |
| 7 | Request content from the content server that points to the Akamai Edge server. |
| 8 | Forward the request to the edge server with the valid HMAC token received from the device. |
| 9 | Verify if the content is available in cache. Pull the content from the Origin Server if the content is not in the cache or if the content has changed. The communication is authorized by the edge identification key passed in the request header from Edge server. |
| 10 | If Edge is in the IP allowlist, the request for the file is processed. If Edge IP is not in the allowlist, then the request for 401/403 is processed. |
| 11 | Stream the content to the devices if the token is valid. |
Configure your Origin Server to integrate Workspace ONE UEM with Akamai CDN
The origin server is a physical location from which content is retrieved. It is required in all configurations that retrieve content from an origin. You can set up the Origin Server to integrate Akamai CDN with Workspace ONE UEM.
To set up the Origin Server, complete the following steps.
-
Install IIS Server Manager.
-
Once the IIS Server Manager is installed, enable the following server roles under Web Server (IIS) > Web Server > Security.
- Request Filtering
- Window Authentication
- URL Authorization
- IP and Domain Restrictions
- Basic Authentication
- Client Certificate Mapping Authentication
- IIS Client Certificate Mapping Authentication
-
Add the following extensions to the Default Website > MIME Types.
Extension Content type .act application/octet-stream .afx application/octet-stream .agt application/octet-stream .apf application/vnd.android.package-archive .apk application/vnd.android.package-archive .appx application/vns.ms-appx .appxbundle application/octet-stream .ast application/octet-stream .bat text/plain .bin application/octet-stream .ccp application/octet-stream .cfg application/octet-stream .cgd application/octet-stream .chn application/octet-stream .chx application/octet-stream .cix application/octet-stream .cni application/octet-stream .cnm application/octet-stream .crd application/x-mscardfile .crt application/x-x509-ca-cert .dat application/octet-stream .db application/octet-stream .demconfig application/octet-stream .der application/x-x509-ca-cert .dmg application/octet-stream .dmp application/octet-stream .ezp application/octet-stream .flg application/octet-stream .gif image/gif .gnf application/octet-stream .Gnu application/octet-stream .gst application/octet-stream .hsh application/octet-stream .inf application/x-inf .inx application/octet-stream .ipa application/octet-stream .json application/json .lic text/plain .lje application/octet-stream .loc application/octet-stream .log text/plain .lup application/octet-stream .map application/octet-stream .mpkg application/octet-stream .mscript application/octet-stream .msi application/octet-stream .msp application/octet-stream .mst application/octet-stream .nix application/octet-stream .nms application/octet-stream .nst audio/x-mod .p12 application/x-pkcs12 .pem application/x-pem-file .pfx application/x-pkcs12 .pho application/octet-stream .pkg application/octet-stream .plist text/xml .png image/png .pnm image/x-portable-anymap .ppkg application/octet-stream .properties application/octet-stream .ps1 text/plain .qd application/octet-stream .rgn application/octet-stream .set application/set .six application/octet-stream .snm application/octet-stream .sst application/vnd.ms-pki.certstore .syn application/octet-stream .thn application/octet-stream .tmp application/octet-stream .tmz application/octet-stream .trp application/octet-stream .txt text/plain .typ application/octet-stream .typ2 application/octet-stream .upl application/octet-stream .xap application/x-silverlight-app .xbap application/x-ms-xbap .xml text/xml .yix application/octet-stream .ynm application/octet-stream .zip application/zip .zst application/zstd Note:
- MIME Types exist in Windows 2012 R2.
- If any of the file type is missing, you can add the extension per your requirement.
-
Create a shared folder named CDN. The folder that is configured for the web server must be mapped to a file with both read and write permissions that is available to the Workspace ONE UEM console and the Device Services. As a best practice, create a separate partition E drive from local disk drive and then create the CDN folder under the newly created partition E drive. For example, you can create E:\CDN
-
In the CDN folder, create a file named monitor.txt. Enter some random text into the document so that you can validate the connection at a later stage.
Note:
- File extension check box is cleared.
- Make sure the filename does not contain the file extension.
-
On IIS, right-click Default Website. Select Manage Website, and select Advanced Settings. Change the Physical Path to the configured drive for the CDN content. For example, E:\CDN .
-
Set up the Physical Path Credential to the service accountor the local user.
-
Ensure you have access to a service account or local user account credentials for accessing the CDN using a UNC/SMB path. The UNC/SMB path is used during the configuration of the UEM console. The username and password are used for connecting to the UNC/SMB folder and are also entered into the UEM console.
-
Set up the Physical Path Credentials Logon to clear text.
-
Configure the security setup for accessing the folder from the IIS website.
- Add the application pool user account to the CDN folder of the shared drive.
- Add the following users:
- ISUR (All but Full control).
- IIS_IUSRS (All but Full control).
- NetworkService (Full Control).
- UNC/SMB Service Account (All but Full control).
-
Under Application Pools, right-click DefaultAppPool and select Advanced Settings. Set the App Pool Identityto NetworkService.
-
Make sure you have installed Application Request Routing (ARR) on IIS. If you have not installed ARR, see Application Request Routing.
-
After Akamai is configured, you can set up the request filtering for the cookie that is used for the authentication of the URL.
- Obtain the CDN Configuration Tool installer.
- Run the CDN installation
-
Click Next on the Welcome to Install Shield Wizard.
-
Enter the SHA256 Authentication key.
Note: The SHA256 key is generated using any string of your choice. You can use any SH256 string generator tool at your disposal. The key used in this step is later used in Akamai account configuration for identifying Edge Servers.
-
Click Install.
-
-
CDN installer must create the URL rewrite. If URL rewrite is not created, perform the following steps:
- Install Application Request Routing https://www.iis.net/downloads/microsoft/application-request-routing. The URL rewrite shows up only after you install the Application Request Routing.
- Run the CDN installer again to install URL Rewrite.
-
Navigate to the CDN folder E:\CDN. Right-click the CDN folder and go to Sharing. Make a note of the Network Path for the UEM console configuration.
-
Perform the following validation.
- Two rules are created for URL Rewrite.
- IgnoreMonitorFile - Ignores the monitor.txt file that is created under the CDN folder.
- AkamaiSharedKeyCookie – Allows Akamai to use the SHA256 key to authenticate into this server.
- Navigate to localhost/monitor.txt on the web browser. A random text is entered in the monitor.txt file.
- Two rules are created for URL Rewrite.
Setting up your Origin server for High Availability and Disaster Recovery
You can configure the Origin Server behind a load balancer to have high availability. Whether you configure the server as Active-Active mode or Active-Passive mode, it is based on the network requirement for your environment. Session persistence is not required if the file optimization feature is enabled on Akamai portal. With file optimization enabled, requests are broken down to ranges eliminating the need for persistence.
This section lists configurations required for a highly available system. The setup is the same as the single Origin server with a few minor differences. In single Origin Server setup, the physical path is set to a CDN folder created in one of the drives of the server.
In the high availability setup, the physical path is set to the network directory. It can be part of any file sharing system if the right permissions are assigned to the user accessing the network directory. The service account must be the owner of the whole network folder.
When you point to the network file system, the web configuration file is no longer in the local machine. Instead, it resides in the destination file-sharing system. The web configuration file stores the IIS configuration. On the remaining origin servers, go through the setup with the following exceptions.
- Point the default website to the network path of the file sharecluster instead of the drive on the server.
- Skip running the CDN installer tool for the URL rewrite setup. This step is only needed on one of the origin servers.
Configure Akamai CDN to integrate with Workspace ONE UEM
Akamai CDN must be configured to communicate with Workspace ONE UEM origin server and your end-user devices. You can set up various download properties in the Akamai portal as per your business needs by working with your Akamai representative. To learn more about configuring Akamai integration, see Akamai product documentation at https://www.akamai.com. However, the following communication properties are required for the distribution from Workspace ONE UEM to work.
-
Create Property> Download delivery (used by Workspace ONE UEM SaaS) and provide a name to the property. As a best practice, consider using Workspace ONE environmentor the datacenter name.
-
Add the property hostname. The property hostname is used for the configuration in the Workspace ONE UEM console in the next section.
-
A certificate is required to bind with the hostname created. The certificate can be Akamai issued certificate or a third-party party issued certificate. For more support, reach out to Akamai.
-
After you set up the properties that control Akamai's edge server traffic, add behaviors to the property as per your requirements. Currently, Workspace ONE UEM requires you to configure the following two behaviors.
-
Origin Server: Include the origin server hostname that is publicly available.
Settings Description Origin Type Your Origin Origin Server Hostname This is the public-facing hostname for the origin server Forward Host Header Origin Hostname Cache key hostname Origin Hostname HTTP Port 80 HTTPS Port 443 -
Edge Server Identification: Include a known cookie value that can be verified at the origin server before serving requests back to the edge server.
Settings Description Cookie Name AW-AUTH-KEY. Cookie Value Use the SHA256 Authentication Key generated in step 9 of the previous, origin server setup section to create the hash key generated value. CDN server uses the key to connect to the origin server. Cookie Domain Enter the Origin Server URL. For example, enter origin.acme.com. The address must match the origin server hostname and is case sensitive. -
Auth Token 2.0 verification: Specify the expected shared-secret/salt that is used to generate the HMAC token when validating the file requests to the edge server. Advanced Override is only available by request from the Akamai Support and may require additional fees. You need this feature to enter the Token key in the console configuration.
Settings Description Token Location Query String Token Name This is the same token parameter in Workspace ONE UEM console under Groups & Settings > All Settings > System > Enterprise Integration > CDN > Akamai. This is case sensitive. Encryption Key Click the button on the right side to generate the key. This key will be used in the configuring Workspace ONE UEM console. Encryption equals Salt Value. Action Verify and Deny
-
Configure Akamai CDN in the Workspace ONE UEM Console
You can configure Akamai CDN in Workspace ONE UEM console. During the configuration, the values that you enter in the configuration page is retrieved by logging in to your CDN provider portal and locating the values. Before You Begin, ensure you finished your origin server setup and Akamai portal configuration.
Complete the Akamai configuration in the Workspace ONE UEM console:
-
In the UEM console, ensure that you are on Global OG.
Note: CDN configuration can be set up only at Global OG.
-
Navigate to Groups & Settings > All Settings > System > Enterprise Integration > CDN.
-
Complete the Akamai configuration settings:
Setting Description Enabled Select Enabled to route all the application downloads through the CDN for all the devices that are managed at the current organization group. Select Disabled to route all the application downloads through Workspace ONE UEM server. Directory Enter the server name and the directory. The Directory name is the Network Path that is used while configuring the origin server. Note: If your origin server has the high-avaiblity setup, enter the path to the file share cluster here. User name Enter a Service Account username that has read/write permissions on the origin server directory. Password Enter the dedicated Service Account password that is placed on the Origin Server side. Content Server Enter the DNS of the CNAME that is as per the data center (for example, CDN.acme.com). Token Parameter For Akamai, it is the token as per the Advanced Override. Salt Value Enter the token that your CDN provides. This is Encryption key in Akamai settings. For Akamai, it is done by enabling Advanced Override code. Destination Enter the destination name of the CDN. -
After you save the configuration, click Test Connection to validate CDN setup end-to-end based on your settings. The validation uploads a dummy file to the origin server, checks if file saves and tries to download it from Akamai using the CDN download URL.
Validate Your Workspace ONE UEM Integration with Akamai CDN
Complete the following steps to validate Workspace ONE UEM integration with CDN:
- In a web browser, navigate to CDN DNS. For example, CDN.acme.com/monitor.txt). The validation results in an error because the connection to the Origin server from the CDN requires authentication.
- In a web browser, navigate to Origin DNS. For example,origin.acme.com/monitor.txt). The validation succeeds. Accessing the origin server directly only works for the monitor.txt file, which is used to validate the connection.
Akamai CDN Servers Per Data Center
이 페이지가 도움이 되었나요?