// to display images directly on GitHub
ifdef::env-github[]
:encoding: UTF-8
:lang: en
:doctype: book
:toc: left
:imagesdir: ../../images
endif::[]

////

    This file is part of the PacketFence project.

    See PacketFence_Installation_Guide.asciidoc
    for authors, copyright and license information.

////


//=== MobileIron

==== Configure MobileIron

First of all you will need to configure the basic functionality of MobileIron using their documentation.

===== MDM profile

One important step is to enable the MDM profile like in this screenshot. 
Note that this will require you to create an MDM certificate with Apple. Refer to the MobileIron documentation for specifics about this step.

image::mobile-iron-mdm-profile-config.png[scaledwidth="100%",alt="MDM profile configuration"]

==== Create an API user

Next, we will need a user that has the rights to access the MobileIron API in order to verify the state of the devices directly from PacketFence.

First go in the 'USERS & DEVICES' tab and then in 'Users' and click 'Add local user'.

image::mobile-iron-go-to-add-user.png[scaledwidth="100%",alt="Go to add user"]

Now enter the information about your user and note the user ID and password for usage in the PacketFence configuration, then hit 'Save'.

image::mobile-iron-create-user.png[scaledwidth="100%",alt="Go to add user"]

Now go in the 'ADMIN' tab, check the box next to your newly created user and then in 'Actions' select 'Assign to Space'.

image::mobile-iron-go-to-assign-space.png[scaledwidth="100%",alt="Go to assign space"]

Select the Global space at the top and then check API at the bottom.
You should now see API in the roles list of your newly created user when viewing the users list.

==== Gather the boarding host

To find the boarding host, add a fake device to MobileIron and at the end of the process you will see the registration instructions.

In it you will find the boarding host and port for the PacketFence configuration. In this case, the boarding host is `m.mobileiron.net` and the boarding port is `50291`.

image::mobile-iron-boarding.png[scaledwidth="100%",alt="Boarding info"]

==== Configure PacketFence

In PacketFence, MDM are referred to as provisioners. 
This will walk you through adding MobileIron as a provisioner.

===== Create the provisioner

Login in the PacketFence administration interface, then go in the 'Configuration' tab, then in 'Provisioners'.
Click 'Add provisioner' then select 'mobileiron'.

image::mobile-iron-pf-config.png[scaledwidth="100%",alt="MobileIron configuration"]

Now configure this new provisioner with the information you got above.

[options="compact"]
* The Provisioning ID is the friendly name of the provisioner.
* The Username is the user you created with API access above.
* The password is the password of the API user.
* The host is the domain name of the instance + your account name if you have a cloud account (ex: `m.mobileiron.net/accountName`)
* Now add the download URI for the agent. See below for more details.
* The Boarding host is the host that you got in step 3.
* The Boarding port is the port that you got in step 3.

Here are the URIs that should work by default. 
Replace `accountName` by your real account/instance name at MobileIron.

[options="compact"]
* Android: `https://m.mobileiron.net/accountName/c/d/android.html`
* IOS devices: `https://m.mobileiron.net/accountName/c/d/ios.html`
* Windows: `https://m.mobileiron.net/accountName/EnrollmentServer/Discovery.svc`

===== Add the provisioner to the connection profile

In order for the provisioner to be used by your captive portal you need to add it in its configuration.
Go in 'Connection Profiles', then select the portal you want to modify and add 'mobileiron' as a provisioner.

image::mobile-iron-portal.png[scaledwidth="100%",alt="MobileIron portal"]

==== Add the necessary passthroughs

Next, still in the PacketFence administration console, go in 'Fencing' in the left menu, then scroll then to 'Passthroughs'.

Check the 'Passthrough' box above the field and add the following domains to the passthrough list.

[options="compact"]
* m.mobileiron.net
* *.itunes.apple.com
* itunes.apple.com
* play.google.com
* *.play.google.com 

image::mobile-iron-passthroughs.png[scaledwidth="100%",alt="MobileIron passthroughs"]

===== Restart PacketFence

In order to enable the boarding passthrough for the device enrollment, you will need to restart the iptables service of PacketFence.

You can do this using the command line by doing '/usr/local/pf/bin/pfcmd service iptables restart' or in the administration interface under 'Status / Services'.

==== Testing

You can now test that MobileIron is mandatory after the device registration.
Connect a device to your test network and register like you normally would.
At the end of the registration process you will be presented a page asking you to install the MobileIron on your device.
After you install the agent click 'Continue'. If your access is enabled than this means the connectivity between PacketFence and MobileIron is good.
