diff --git a/docs/html/_redirects.yaml b/docs/html/_redirects.yaml index 69e598ad84b17..4a2f23284e8ce 100644 --- a/docs/html/_redirects.yaml +++ b/docs/html/_redirects.yaml @@ -703,8 +703,18 @@ redirects: to: /training/location/index.html - from: /google/gcm/adv.html to: /google/gcm/gcm.html -- from: /work - to: /training/enterprise/index.html +- from: /training/enterprise/index.html + to: /work/index.html +- from: /training/enterprise/app-compatibility.html + to: /work/managed-profiles.html +- from: /training/enterprise/app-restrictions.html + to: /work/app-restrictions.html +- from: /training/enterprise/cosu.html + to: /work/cosu.html +- from: /training/enterprise/device-management-policy.html + to: /work/device-management-policy.html +- from: /training/enterprise/work-policy-ctrl.html + to: https://developers.google.com/android/work/build-dpc - from: /distribute/tools/promote/badge-files.html to: https://play.google.com/intl/en_us/badges/ - from: /google/gcm/... diff --git a/docs/html/distribute/googleplay/work/about.jd b/docs/html/distribute/googleplay/work/about.jd index a31bca2755c8a..79e8a899f46f0 100644 --- a/docs/html/distribute/googleplay/work/about.jd +++ b/docs/html/distribute/googleplay/work/about.jd @@ -52,10 +52,13 @@ page.image=images/distribute/gpfw.jpg

Develop a great app for business

@@ -260,30 +245,9 @@ enterprise administrator to:

the {@link android.content.Intent#ACTION_APPLICATION_RESTRICTIONS_CHANGED ACTION_APPLICATION_RESTRICTIONS_CHANGED} intent to find out if restrictions change while your app is active, as described in Listen for - App Restriction Changes. + Device Configuration Changes.

-

- When your app checks for restrictions using - {@link android.content.RestrictionsManager#getApplicationRestrictions - RestrictionsManager.getApplicationRestrictions()}, we recommend that you - check to see if the enterprise administrator has set the key-value pair - {@link android.os.UserManager#KEY_RESTRICTIONS_PENDING} to true. If so, you - should block the user from using the app, and prompt them to contact their - enterprise administrator. The app should then proceed as normal, registering - for the {@link android.content.Intent#ACTION_APPLICATION_RESTRICTIONS_CHANGED - ACTION_APPLICATION_RESTRICTIONS_CHANGED} broadcast. -

- - - -

- Figure 1. Checking whether restrictions are pending before - registering for the broadcast. -

-

Reading and applying restrictions

@@ -293,11 +257,11 @@ width="620" srcset="{@docRoot}images/training/enterprise/app_restrictions_diagra getApplicationRestrictions()} method returns a {@link android.os.Bundle} containing a key-value pair for each restriction that has been set. The values are all of type Boolean, int, - String, String[], Bundle, and - Bundle[]. Once you have the restrictions {@link android.os.Bundle}, - you can check the current restrictions settings with the standard - {@link android.os.Bundle} methods for those data types, such as - {@link android.os.Bundle#getBoolean getBoolean()} or + String, and String[]. Once you have the + restrictions {@link android.os.Bundle}, you can check the current + restrictions settings with the standard {@link android.os.Bundle} methods for + those data types, such as {@link android.os.Bundle#getBoolean getBoolean()} + or {@link android.os.Bundle#getString getString()}.

@@ -311,11 +275,10 @@ width="620" srcset="{@docRoot}images/training/enterprise/app_restrictions_diagra

It is up to your app to take appropriate action based on the current - restrictions settings. For example, if your app has a restriction schema - to specify whether it can download over a cellular connection (like the - example in Define App Restrictions), - and you find that the restriction is set to false, you would have to disable - data download except when the device has a Wi-Fi connection, as shown in the + restrictions settings. For example, if your app has a restriction specifying + whether it can download data over a cellular connection, and you find that + the restriction is set to false, you would have to disable data + download except when the device has a Wi-Fi connection, as shown in the following example code:

@@ -335,13 +298,6 @@ if (!appCanUseCellular) { // ...show appropriate notices to user } -

- Note: The restrictions schema should be - backward and forward compatible, since Google Play for Work - gives the EMM only one version of the App Restrictions - Schema per app. -

-

Listen for App Restriction Changes

@@ -389,8 +345,8 @@ registerReceiver(restrictionsReceiver, restrictionsFilter); Note: Ordinarily, your app does not need to be notified about restriction changes when it is paused. Instead, you should unregister your broadcast receiver when the app is paused. When the app resumes, you - first check for the current restrictions (as discussed in - Check App Restrictions), then register - your broadcast receiver to make sure you're notified about restriction changes + first check for the current restrictions (as discussed in Check Device Restrictions), then register your + broadcast receiver to make sure you're notified about restriction changes that happen while the app is active.

diff --git a/docs/html/training/enterprise/cosu.jd b/docs/html/work/cosu.jd similarity index 90% rename from docs/html/training/enterprise/cosu.jd rename to docs/html/work/cosu.jd index 1d6388b459637..3058365a150a4 100644 --- a/docs/html/training/enterprise/cosu.jd +++ b/docs/html/work/cosu.jd @@ -1,27 +1,20 @@ -page.title=Configuring Corporate-Owned, Single-Use Devices +page.title=Set up Single-Purpose Devices +page.tags=work, cosu +page.keywords=cosu, work page.metaDescription=Learn how to develop single-use solutions for Android devices. +page.image=images/work/cards/briefcase_600px.png @jd:body -
-
- -

This lesson teaches you to

-
    -
  1. How to use LockTask mode
    2. -
  2. Build COSU solutions
    3. -
  3. Create your own DPC app
    4. -
- - -

You should also read

- - -
+
+

@@ -73,9 +66,9 @@ a more robust way to manage COSU devices, as discussed below. This graphic compares the features of app pinning and lock task mode:

- +

Figure 1. Comparing the features of app pinning in Lollipop @@ -422,7 +415,7 @@ public class CosuActivity extends Activity { // set System Update policy if (active){ - mDevicePolicyManager.setSystemUpdatePolicy(mAdminComponentName, + mDevicePolicyManager.setSystemUpdatePolicy(mAdminComponentName, SystemUpdatePolicy.createWindowedInstallPolicy(60,120)); } else @@ -431,7 +424,7 @@ public class CosuActivity extends Activity { // set this Activity as a lock task package mDevicePolicyManager.setLockTaskPackages(mAdminComponentName, - active ? new String[]{getPackageName()} : new String[]{}); + active ? new String[]{getPackageName()} : new String[]{}); IntentFilter intentFilter = new IntentFilter(Intent.ACTION_MAIN); intentFilter.addCategory(Intent.CATEGORY_HOME); @@ -460,18 +453,18 @@ public class CosuActivity extends Activity { } private void enableStayOnWhilePluggedIn(boolean enabled) { - if (enabled) { - mDevicePolicyManager.setGlobalSetting( - mAdminComponentName, - Settings.Global.STAY_ON_WHILE_PLUGGED_IN, - BatteryManager.BATTERY_PLUGGED_AC - | BatteryManager.BATTERY_PLUGGED_USB - | BatteryManager.BATTERY_PLUGGED_WIRELESS); - } else { - mDevicePolicyManager.setGlobalSetting( - mAdminComponentName, - Settings.Global.STAY_ON_WHILE_PLUGGED_IN, 0); - } + if (enabled) { + mDevicePolicyManager.setGlobalSetting( + mAdminComponentName, + Settings.Global.STAY_ON_WHILE_PLUGGED_IN, + BatteryManager.BATTERY_PLUGGED_AC + | BatteryManager.BATTERY_PLUGGED_USB + | BatteryManager.BATTERY_PLUGGED_WIRELESS); + } else { + mDevicePolicyManager.setGlobalSetting( + mAdminComponentName, + Settings.Global.STAY_ON_WHILE_PLUGGED_IN, 0); + } } diff --git a/docs/html/training/enterprise/device-management-policy.jd b/docs/html/work/device-management-policy.jd similarity index 99% rename from docs/html/training/enterprise/device-management-policy.jd rename to docs/html/work/device-management-policy.jd index 5190a22651d0b..d564b8969512f 100644 --- a/docs/html/training/enterprise/device-management-policy.jd +++ b/docs/html/work/device-management-policy.jd @@ -24,7 +24,7 @@ parent.link=index.html

Try it out

- Download the sample

DeviceManagement.zip

diff --git a/docs/html/work/guide.jd b/docs/html/work/guide.jd new file mode 100644 index 0000000000000..66ffb99b876ec --- /dev/null +++ b/docs/html/work/guide.jd @@ -0,0 +1,530 @@ +page.title=Android for Work Developer Guide +page.tags="work", "android for work", "afw", "developer", "android" +page.metaDescription=Android for Work provides organizations with a secure, flexible, and unified Android mobility platform combining devices, applications, and management. +page.image=images/work/cards/android-studio_600px.png + +@jd:body + +
+ +
+ +

+ Android for Work provides organizations with a secure, flexible, and + unified Android mobility platform—combining devices, applications, + and management. By default, Android apps are compatible with Android + for Work. However, there are additional features you can use to make + your Android app work best on a managed device: +

+ + + +

Prerequisites

+ +
    +
  1. You’ve created an Android app.
    2. +
  2. You’re ready to modify your app so that it works best with + Android for Work.
    3. +
  3. Minimum version: Android 5.0 Lollipop recommended version: + Android 6.0 Marshmallow and later.
    4. +
+ +

+ Note: Android for Work functions natively on most + Android 5.0 devices; however, Android 6.0 and later offers + additional features for Android for Work, especially with regard to + COSU. +

+ +

Manage Profiles

+ +

+ You can manage a user’s business data and applications through a + work profile. A work profile is a managed corporate profile + associated with the primary user account on an Android device. A + work profile securely isolates work apps and data from personal apps + and data. This work profile is in a separate container from the + personal profile, which your user controls. These separate profiles + allow organizations to manage the business data they care about, but + leave everything else on a user’s device under the user’s control. + For a deep dive into best practices, see the + Set up Managed Profiles + guide. For an overview of those best practices, see below. +

+ +

Key features of a managed profile

+ + + +

Managed profile benefits on Android 5.0+

+ + + +

Considerations for managed profiles

+ + +

Prevent intents from failing between profiles

+

+ It’s difficult to know which intents can cross between profiles, and + which ones are blocked. The only way to know for sure is by testing. + Before your app starts an activity, you should verify that the + request is resolved by calling + Intent.resolveActivity(). +

+

+

+ Note: For detailed testing instructions, see + Prevent Failed Intents. +

+ +

Share files across profiles

+

+ Some developers use URIs to mark file paths in Android. However, + with Android for Work, because there are separate profiles, we + recommend: +

+ + + + + + + + + + +
+ Use:
+ Content URIs + 		+
    +
  • + The content URIs contain the authority, path, and ID for a + specific file. You can generate this using + FileProvider subclass. + Learn more +
    • +
  • + Share and grant permissions to access the content URI using + an Intent. Permissions can only be passed across the profile + boundary using Intents. If you grant another app access rights + to your file using + Context.grantUriPermission(), it only is granted for + that app in the same profile.
    • +
+
+ Don't use:
+ File URI + 		+
    +
  • Contains the absolute path of the file on the device’s + storage.
    • +
  • A file path URI that’s valid on one profile isn’t valid on + the other.
    • +
  • If you attach a file URI to an intent, a handler is unable + to access the file in another profile.
    • +
+
+ +

+ Next steps: Once your app supports managed + profiles, test it in a work profile. See + Test your app with Android for Work. +

+ +

Implementing App Restrictions

+ +

+ App restrictions are a set of instructions that IT administrators + can use to manage their users’ mobile devices in a specific way. + These instructions are universal and work across any EMM, allowing + administrators to remotely configure applications on their users’ + phones. +

+ +

+ If you’re developing apps for business or government, you may need + to satisfy your industry’s specific set of requirements. Using + application restrictions, the IT administrator can remotely specify + settings and enforce policies for their users’ Android apps; for + example: +

+ + + +

Best practices for implementing app restrictions

+ +

+ The Set up App Restrictions + guide is the key source for information on how to build and deploy + app restrictions. After you’ve reviewed this documentation, see + recommendations below for additional guidance. +

+ +

When first launching the app

+

+ As soon as you launch an application, you can see if app + restrictions are already set for this app in onStart() or + onResume(). Additionally, you can find out if your + application is managed or unmanaged. For example, if + getApplicationRestrictions() returns: +

+

+ +

Listen for changes to app restrictions

+

+ IT administrators can change app restrictions and what policies they + want to enforce on their users at any time. Because of this, we + recommend you ensure that your app can accept new restrictions as + follows: +

+ + + +

COSU Devices

+ +

+ Corporate-owned, single-use devices (COSU) are kiosk devices used + for a single purpose, such as digital signage displays, ticket + printing kiosks, or checkout registers. +

+

+ When an Android device is configured as a COSU device, the user sees + an application locked to the screen with no Home or Recent Apps + buttons to escape the app. COSU can also be configured to show a set + of applications, such as a library kiosk with an app for the library + catalog and a web browser. +

+

+ For instructions, see + Set up Single-Purpose Devices. +

+ +

Set up Single Sign-on with Chrome Custom Tabs

+ +

+ Enterprise users often have multiple apps on their device, and they + prefer to sign in once to access all of their work applications. + Typically, users sign in through a + WebView; + however, there are a couple reasons why this isn’t ideal: +

+
    +
  1. + Users often need to sign in multiple times with the same + credentials. The WebView solution often isn’t a true Single + Sign-On (SSO) experience. +
    2. +
  2. + There can be security risks, including malicious applications + inspecting cookies or injecting JavaScript® to access a user’s + credentials. Even trusted developers are at risk if they rely on + potentially malicious third-party SDKs. +
    3. +
+ +

+ A solution to both problems is to authenticate users using Chrome + Custom Tabs, instead of WebView. This ensures that authentication: +

+ + +

Requirements

+ +

+ Chrome Custom Tabs are supported using Platform APIs from API level + 23 (Android 6.0), and support libraries back to API level 4 (Android + 1.6). To implement Chrome Custom Tabs, you need to use a supported + browser, such as Chrome 45 or later. +

+ +

How do I implement Chrome Custom Tabs?

+ +

+ Google, in conjunction with the OpenID Foundation, has published an + open source library on GitHub. To set up Chrome Custom Tabs for SSO, + see the documentation and sample code on GitHub. +

+ +

Test your App with Android for Work

+ +

+ Once you’ve developed your app, you’ll want to test it in a work + profile—both as a profile owner and device owner. See the + instructions below. +

+ +

Use TestDPC to test your Android app

+ +

+ TestDPC is a tool you can use to test your Android app in a variety + of Android for Work environments. You can configure it as a profile + owner or a device owner to launch management APIs on your device, + using one of these methods: +

+ +

+ For more information on how to configure TestDPC, see the + instructions below and the + TestDPC User Guide. +

+ +

+ REQUIRED: Your test Android device needs to run + Android 5.0 or later and be able to natively support Android for Work. +

+ +

Provision a profile owner

+ +

+ To test your app in a work profile, you need to first provision a + profile owner on the TestDPC app: +

+ +
    +
  1. Launch the TestDPC app and click Set up profile.
    2. +
  2. When prompted, click Set up, ensuring the + TestDPC’s logo is highlighted on the screen.
    3. +
  3. If your device isn’t encrypted, you need to encrypt your device. + Follow the briefcase notification after reboot to continue + provisioning.
    + Once you’ve provisioned the profile owner correctly, badged + applications appear at the end of your app tray. Install your app + on the device and test to see how it runs in the work profile. +
    4. +
  4. + Install your app on the device and test to see how it runs in the + work profile. +
    5. +
+ +

Provision a device owner

+ +

+ Testing your app as a device owner requires more steps than testing + as a profile owner. You first need to provision the device owner on + your test device using the + NfcProvisioning sample app. For complete instructions to + provision TestDPC in device owner mode using the NfcProvisioning + app, see the TestDPC User Guide. +

+ +
    +
  1. Download the NfcProvisioning app sample files to your development environment.
    2. +
  2. Unpack the project, open your shell, and cd to the project directory.
    3. +
  3. Add a file to the directory with the local.properties name + and the following content: + 
    sdk.dir=/path/to/your/android/sdk
    +
    4. +
  4. While in the project directory, enter these commands to build the NfcProvisioning APK: + 
    ./gradlew init
+./gradlew build
    + The NfcProvisioning APK you need is now located in ./Application/build/outputs/apk. +
    5. +
  5. Install the APK on your programmer device, which you can use to provision other devices.
    6. +
  6. Create a text file called nfcprovisioning.txt and + include the following information: + 
    android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME=com.afwsamples.testdpc
+android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION=https://testdpc-latest-apk.appspot.com
+android.app.extra.PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM=gJD2YwtOiWJHkSMkkIfLRlj-quNqG1fb6v100QmzM9w=
+# note: checksum must be URL-safe
+android.app.extra.PROVISIONING_LOCALE=en_US
+android.app.extra.PROVISIONING_TIME_ZONE=America/New_York
    +

    + Note: If you’re developing for Android 5.0 + Lollipop, see the instructions in the + TestDPC User Guide. +

    +
    7. +
  7. Push that text file to your programmer device by entering: + 
    adb push <path-to-nfcprovisioning.txt> /sdcard/
    +
    8. +
  8. + Ensure that the programmer device is connected to Wi-Fi on either + an unsecured or WPA2 secured network. +

    + The NFC Provisioning app will automatically pass those Wi-Fi + credentials onto the target device. +

    +
    9. +
  9. Open the NFC Provisioning app and ensure com.google.android.testdpc + is auto-populated.
    10. +
  10. Bump the devices to transfer the data.
    11. +
  11. Follow the onscreen instructions to set up your target device.
    12. +
  12. Once you’ve completed provisioning the device owner, you can test your app on that device. You + should specifically test how + app restrictions, + URIs, and + intents + work on that device.
    13. +
+ +

End-to-end testing

+ +

+ After you’ve finished testing your app in the environments above, + you’ll likely want to test your app in an end-to-end production + environment. This process includes the steps a customer needs to + take to deploy your app in their organization, including: +

+ + + +

+ You need to access an EMM console to complete the end-to-end + testing. The easiest way to get one is to request a testing console + from your EMM. Once you have access, complete these tasks: +

+ +
    +
  1. Create a test version of your application with a + new ApplicationId.
    2. +
  2. Claim a managed Google domain and bind it to your EMM. If you + already have a testing domain that’s bound to an EMM, you may need + to unbind it to test it with your preferred EMM. Please consult your + EMM for the specific unbinding steps.
    3. +
  3. Publish your application to the private channel for their + managed Google domain.
    4. +
  4. Use the EMM console and EMM application to: +
      +
    1. Set up work devices.
      2. +
    2. Distribute your application.
      3. +
    3. Set application restrictions.
      4. +
    4. Set device policies.
      5. +
    +
+ +

+ This process will differ based on your EMM. Please consult your + EMM’s documentation for further details. Congrats! You’ve completed + these steps and verified that your app works well with Android for + Work. +

+ +

+ + + Learn about the Android for Work DevHub. + +

diff --git a/docs/html/work/index.jd b/docs/html/work/index.jd new file mode 100644 index 0000000000000..a71fedb730b4e --- /dev/null +++ b/docs/html/work/index.jd @@ -0,0 +1,55 @@ +page.title=Android for Work +page.tags="android for work, work", +meta.tags="android for work, work", +fullpage=true +section.landing=true +header.hide=1 +footer.hide=1 +@jd:body + +
+
+
+
+ +
+
+

Android for Work

+

+ Develop apps for Android for Work to take advantage of + security and management features built into Android. +

+ + + + Get Started + +
+
+
+
+
+
+
+ +
+ + + +
+ +
+
+

Resources

+ +
+
+
diff --git a/docs/html/training/enterprise/app-compatibility.jd b/docs/html/work/managed-profiles.jd similarity index 95% rename from docs/html/training/enterprise/app-compatibility.jd rename to docs/html/work/managed-profiles.jd index 419ba89f3408a..3287f5504c43b 100644 --- a/docs/html/training/enterprise/app-compatibility.jd +++ b/docs/html/work/managed-profiles.jd @@ -1,26 +1,19 @@ -page.title=Ensuring Compatibility with Managed Profiles +page.title=Set up Managed Profiles page.metaDescription=Learn how to make sure your apps operate smoothly in a corporate environment by following some best practices. +page.image=images/work/cards/briefcase_600px.png @jd:body -
- +

The Android platform allows devices to have diff --git a/docs/html/work/overview.jd b/docs/html/work/overview.jd new file mode 100644 index 0000000000000..2b1f08b4d0b2b --- /dev/null +++ b/docs/html/work/overview.jd @@ -0,0 +1,142 @@ +page.title=Android for Work Developer Overview +meta.tags="android for work, work, enterprise, corporate" +page.tags="android for work, work, enterprise, corporate" +page.metaDescription=Learn how to build Android apps for the enterprise and take advantage of Google's Android for Work program. +page.image=images/work/cards/briefcase_600px.png + +@jd:body + +

+ +

+ As an Android for Work developer, you can deploy devices and apps to + employees and keep your corporate data secure. With Android for + Work, organizations can choose what devices, APIs, and framework + they want to use to develop apps. +

+ +

+ With Android for Work, you can: +

+

+ +

+ Additionally, Android for Work offers a partner program for + developers through the + Android for Work DevHub, which provides exclusive access to beta + features and developer events, along with access to a community of + Android developers making enterprise apps. +

+ +

Create Apps Using the Developer Guide

+ +

+ The Android for Work Developer Guide is for developers who want to + create Android apps that best utilize and complement the features in + Android for Work. The guide defines the best practices to develop + and test enterprise-focused apps for Android devices running Android + for Work. +

+ +

If you’re new to creating Android apps ...

+ +

+ The Developer Guide assumes that you’re working as an independent + software vendor (ISV) or in a similar role, and have already built + an Android app. If you haven’t yet created an Android app, see + Building Your First App. If you’re looking for an accelerated + course, see the Developing Android Apps course taught by Google employees. +

+ +

What Does the Android for Work DevHub Offer?

+ +

+ The Android for Work DevHub offers these incentives: +

+ +

Get exclusives

+ +

+ Access to beta features and Android for Work developer training and + events, including invite-only hackathons. +

+ +

Learn from experts

+ +

+ Special content from Android for Work experts, including how to + optimize your app for the Play for Work store so that businesses can + see your app. +

+ +

Talk to others

+ +

+ Access to a moderated space dedicated to enterprise developers. Talk + with peers about issues specific to developing Android apps for + businesses. +

+ +

How do I join?

+ +

+ Apply to join the + Android for Work DevHub. +

+ +

Develop Apps for Enterprises

+ +

+ Learn how to make your app function smoothly in corporate + environments that restrict device features and data access. Go + further to support business use of your app by enabling restrictions + that administrators can use to remotely configure your app: +

+ +
+
+
+
+ + +

Manage Devices and Apps

+ +

+ Learn how to build policy controller apps that enable enterprise + administrators to manage devices, manage corporate apps, and provide + access to company resources: +

+ +
+
+
+
diff --git a/docs/html/work/work_toc.cs b/docs/html/work/work_toc.cs new file mode 100644 index 0000000000000..10658c2e25d8e --- /dev/null +++ b/docs/html/work/work_toc.cs @@ -0,0 +1,44 @@ +