AirWatch Hands-on LabsVMworld 2051HOL-2051-11-UEMModule 1 - Software Distribution for macOSDeploying Non-Store 3rd-Party macOS Applications as Internal Applications

Deploying Non-Store 3rd-Party macOS Applications as Internal Applications

Note: All Workspace ONE UEM Console work for this section should be performed on a macOS device.

VMware recently announced integration with the Open-Sourced "munki" project for third-party application management on enrolled macOS devices. With this integration, administrators can now manage third-party (non-AppStore) software using the internal apps view (closer aligning the admin experience to that of other platforms). The integration allows administrators to consume a global CDN for software delivery, without requiring the administrators to fully understand munki's inner workings and configuration.

In this exercise, you will enable the application catalog and deploy an Application to your device.

Note: Workspace ONE UEM also provides a second facility for delivering software/configurations and running scripts/commands on a macOS device. This method, known as Product Provisioning, is outside the scope of this exercise.   For more information, refer to Deploying Third-Party macOS Applications: VMware Workspace ONE Operational Tutorial on VMware TechZone.

Administrators can deliver software to macOS using multiple methods.  As a quick reference, VMware recommends using the following methods to deliver software to macOS devices:

  • Mac App Store Applications:   VMware recommends delivering any application that may be available on the Mac App Store be delivered as a Volume-Purchased app from Apple Business Manager.   Apps should be assigned via device-based licenses and set to auto-update if the application is not business-critical.
  • Non-Store Applications:   As much as possible, 3rd-Party applications which are not available through the app store should be delivered as an Internal Application (leveraging the underlying munki integration).  

2. Enable macOS Software Management

NOTE:  The steps in this section have already been completed for you in the Hands-On Lab.  You DO NOT need to Enable Software Management as it has already been completed on your behalf.

Prior to deploying a macOS Application, VMware Workspace ONE UEM administrators must enable their environments for Software Management. The following items are pre-requisites for macOS Software Management:

  1. For On-Premise Installations, "File Storage" must be enabled (Settings > Installation > File Path).
  2. "Software Management" must be enabled (Settings > Devices & Users > Apple > Apple macOS > Software Management)
  3. VMware AirWatch Agent for macOS version 3.0 (or newer).   Note the best experience is provided via macOS Intelligent Hub.

2.1. Access All Settings (REFERENCE ONLY)

DO NOT make the following configurations, they are shown only as an example of how to enable Software Management for macOS outside of the Hands on Labs environment!

  1. Click Groups & Settings
  2. Click All Settings

2.2. Enable File Storage (REFERENCE ONLY)

DO NOT make the following configurations, they are shown only as an example of how to enable Software Management for macOS outside of the Hands on Labs environment!

  1. Ensure you are at the Global Organization Group unless your particular setup requires configuring at child Organization Groups.  
  2. Expand Installation
  3. Click File Path
  4. Scroll the file paths screen and click Enabled for File Storage Enabled
  5. Enter the path of a file share accessible from your Device Services and Console servers.
  6. Click Disabled for File Storage Caching Enabled unless you have planned and sized your Device Services server accordingly.
  7. Click Enabled for File Storage Impersonation Enabled
  8. Enter the username credentials to impersonate in order to access the file storage path
  9. Enter the password for the impersonation user
  10. Confirm the password for the impersonation user
  11. Click Test Connection and ensure you see Connection Succeeded
  12. Click Save

2.3. Enable Software Management (REFERENCE ONLY)

DO NOT make the following configurations, they are shown only as an example of how to enable Software Management for macOS outside of the Hands on Labs environment!

  1. Expand Devices & Users
  2. Expand Apple
  3. Expand Apple macOS
  4. Click Software Management
  5. Click Override
  6. Click Enabled for Enable Software Management
  7. Click Save
  8. Ensure settings are Saved Successfully

3. Prepare macOS Applications for Deployment

Note: All Web Browser (Skitch and Admin Assistant) and Workspace ONE UEM Console work for this section should be performed on a macOS device.

In this section, you will download the VMware AirWatch Admin Assistant tool and use it to prepare another 3rd-Party application for deployment.

3.1. Open New Browser Tab

On your macOS device, open a new Safari tab:

  1. Within Safari, click File.
  2. Click New Tab.

3.2. Download Skitch

  1. Enter https://evernote.com/products/skitch in the URL bar.  Press ENTER.
  2. Click Download for Mac.

The zip file for Skitch will download to the Downloads folder.

3.3. Unzip the Skitch.zip Download

  1. Click the Downloads folder.
  2. Click the Skitch-{version}.zip download to extract the contents.
  3. Click the Downloads folder again.
  4. Confirm the Skitch file was extracted.

3.4. Download VMware AirWatch Admin Assistant Tool

In the same tab as you downloaded Skitch, paste the link in Safari to download the VMware AirWatch Admin Assistant tool and press ENTER on the keyboard:   https://awagent.com/AdminAssistant/VMwareAirWatchAdminAssistant.dmg

The DMG file will download to the Downloads folder.

3.5. Begin Installing VMware AirWatch Admin Assistant Tool

On the dock, perform the following:

  1. Click the Downloads folder (next to the Trash).
  2. Click VMwareAirWatchAdminAssistant.dmg.

3.6. Launch Installer Package

Double-click the VMware AirWatch Admin Assistant.pkg file

3.7. Continue Installer

Click Continue

3.8. Review and Continue Installer

  1. Review the License Agreement and click Continue
  2. Click Agree.

3.9. Install Admin Assistant Tool

Click Install

3.10. Enter Admin Credentials

If prompted for administrative credentials, enter the credentials required to install.

  1. Enter the Administrator as the Admin User Name on the macOS device
  2. Enter the VMware1! as the password for the admin user
  3. Click Install Software

3.11. Close the Installer

  1. Click Close when the installer completes
  2. Click Move to Trash to clean up the installer

3.12. Launch VMware Admin Assistant Tool

  1. Click the Launchpad on the Dock
  2. Click VMware AirWatch Admin Assistant

3.13. Drag and Drop Skitch

  1. Click the Downloads folder on the Dock (by the trash).
  2. Click and Drag Skitch.
  3. Drag and Drop Skitch onto the VMware AirWatch Admin Assistant app file upload section.

The VMware Admin Assistant Tool begins parsing the file to extract information necessary to deploy the software.

3.14. Monitor Process and Reveal Files

  1. Monitor the progress of the parsing.  The result will change to a green checkmark when it is completed, which may take 15 - 30 seconds.
  2. In the pop-up window, click Reveal in Finder

3.15. Review Generated Files

In the Finder window:

  1. Change to Column view
  2. Note the Path of the Output for the Skitch files:  ~/Documents/VMware AirWatch Admin Assistant/Skitch-2.8.1
  3. Note the output from the Assistant tool as described below:
Skitch-2.8.1.dmg -- The Application has been packaged into a DMG file.   (Note: MPKG and PKG files will not be modified)
Skitch-2.8.1.plist -- A metadata file (referenced as the pkginfo.plist in munki documentation) which contains information used by the munki framework to determine how to install/uninstall the software
Skitch.png -- An icon image extracted from the app used for user-friendly display in the console and Workspace ONE app for macOS

All output for the Admin Assistant tool follows the convention ~/Documents/VMware AirWatch Admin Assistant/{AppName-Version}.  At the time this lab was created, Skitch was at version 2.8.1 but may be different depending on when you take this lab.

4. Deploy a macOS Application

In Safari, Click on the tab labeled Devices > Dashboard to return to the Workspace ONE UEM Console.

4.1. View Native Internal Apps

  1. Click on Apps & Books
  2. Expand Applications
  3. Click Native
  4. Click Internal
  5. Click Add Application

4.2. Begin Application File Upload

Click Upload

4.3. Choose File

Click Choose File

4.4. Browse and Select Application File

  1. Choose the Documents folder
  2. Select VMware AirWatch Admin Assistant
  3. Select Skitch-{version} (e.g. Skitch-2.8.1)
  4. Select Skitch-{version}.dmg
  5. Click Choose

4.5. Save Local File

Click Save

4.6. Continue Adding Application

Click Continue

4.7. Upload Metadata File

  1. Note the link to directly download the VMware AirWatch Assistant (in case you forgot to generate the metadata file and are working from a computer where the VMware AirWatch Assistant is not installed).   You have already downloaded and installed the VMware AirWatch Assistant, so you continue to the next step.
  2. Click Upload

4.8. Choose File

Click Choose File

4.9. Browse and Select Plist File

  1. Choose the Documents folder
  2. Select VMware AirWatch Admin Assistant
  3. Select Skitch-{version} (e.g. Skitch-2.8.1)
  4. Select Skitch-{version}.plist
  5. Click Choose

4.10. Save Plist File

Click Save

4.11. Continue Adding Application

  1. Note the Application File is shown
  2. Note the Plist File is shown
  3. Click Continue

4.12. Add App Details

  1. Choose the Utilities (System) category
  2. Enter People everywhere use Skitch to help them visually share their thoughts with others. for the Description.

4.13. Add Image File

  1. Click on the Images tab
  2. Click on Click or Drag Files Here

4.14. Browse and Select Image File

  1. Choose the Documents folder
  2. Select VMware AirWatch Admin Assistant
  3. Select Skitch-{version} (e.g. Skitch-2.8.1)
  4. Select {App Name}.png  (e.g. Skitch.png)
  5. Click Choose

4.15. Review Scripts Tab

Use the pre and post install scripts to avoid repackaging installers.   By including scripts, you can automate tasks that would normally be prompted for the user to resolve before/after an install.   More info can be found in the munki Wiki:   https://github.com/munki/munki/wiki/Pre-And-Postinstall-Scripts

  1. The Pre-Install Script runs BEFORE the Intelligent Hub executes the dmg/pkg/mpkg file that installs the Application and can be used to set-up pre-requisite items before the installer runs.  The Pre-install Script must have an exit code of zero (0) in order for the install to proceed.
  2. The Post-Install Script runs AFTER the Intelligent Hub executes the dmg/pkg/mpkg file.   This can be useful for applying configurations after the software completes the installation.
  3. The Pre-Uninstall Script runs BEFORE the Intelligent Hub initiates the uninstall.  The Pre-Uninstall script must have an exit code of zero (0) in order for the uninstall to proceed.
  4. The Uninstall Method defines how the Intelligent Hub uninstalls software.  Typically, "Remove Copied Items" is used for a DMG installer, and "Remove Packages" is used for a PKG installer.  
  5. The Post-Uninstall Script provides a method to validate an uninstall was completed and potentially handle any cleanup for the uninstall.
  6. The Install Check script assists the Intelligent Hub with determining whether an install needs to happen.  This script can be useful for "desired state" purposes and ensuring that a software install remains intact on a user's machine.   If the script has an exit code of zero (0), the agent assumes an Install is needed.
  7. The Uninstall Check Script validates whether an uninstall has occurred.  If the script has an exit code of zero (0), the Intelligent Hub determines an uninstall is (or is still) required.
  1. Click the Scripts tab
  2. Enter the following Code for the Post-Install Script
  3. Ensure the Uninstall Method is Remove Copied Items
  4. Observe the script uses a new utility bundled with the Intelligent Hub (hubcli).   hubcli provides a client-side command line interface to configure Hub settings, generate notifications, and trigger sync.     
#!/bin/bash
/usr/local/bin/hubcli notify -t 'Skitch Install Complete' -i 'Skitch is now installed on your Mac!' -c 'Thanks!'

Scripts must include the shebang (#!) statement on the first line.  Examples include the following:

#!/bin/bash
#!/bin/sh
#!/usr/bin/python

4.16. Review Deployment Tab

  1. Click the Deployment tab
  2. Note the ability to enable "Blocking Applications" and define which applications can block the install
  3. Note the different Restart actions
  4. Note the section to include conditions which can further constrain the deployment.

For more information about Conditions, refer to the munki wiki:  https://github.com/munki/munki/wiki/Conditional-Items

4.17. Review Terms of Use and Save Application

  1. Click Terms of Use
  2. Review the ability to add terms of use to a software title.  
  3. Click Save & Assign

4.18. Add Assignment

Click Add Assignment

4.19. Select Assignment Group and Add

  1. For the Assignment Group, enter All Devices and select the All Devices ([email protected]) group.
  2. Click On Demand for App Delivery Method
  3. Click Show for Display in App Catalog
  4. Click Enabled for Desired State Management
  5. Click Enabled for Remove on Unenroll
  6. Click Add

4.20. Save and Publish

  1. Ensure your recently added Assignment shows in the list of Assignments
  2. Click Save and Publish

4.21. Publish the Application

Click Publish

4.22. Review Published Application Information

Review the newly published application.

5. Validate Application Install

Since the application was published On-Demand, this section illustrates how a user could select the app via Self-Service from the Intelligent Hub.

5.1. Open Intelligent Hub

From the macOS device:

  1. If not already open, click the Intelligent Hub icon on the Dock.
  2. Click the App Catalog button.
  3. If already open, or no apps are showing, click the Refresh icon.
  4. Note the new app category added due to Skitch being assigned.
  5. Click on Skitch.

5.2. Install Skitch

  1. Note the user has capabilities to provide app ratings back to administrators
  2. Note the description of the app as provided by the admin when the app was published
  3. Click Install
  4. Click Install
  5. Click Back to Apps

5.3. Note Install Status

  1. Click the Install Status icon in the top right side of the Intelligent Hub
  2. Observe the Install Status for Skitch
  3. Click the X to close the Install Status

5.4. Observe Hubcli Notification

Observe the notification generated by hubcli when the Skitch installation completes.  

For more information on hubcli:

  1. open Terminal.app on a Mac with Intelligent Hub installed
  2. type sudo hubcli -help

5.5. Launch Terminal

  1. Click the LaunchPad on the Dock
  2. Begin typing terminal to filter the LaunchPad apps
  3. Click Terminal

5.6. Review ManagedSoftwareUpdate Log

  1. Tail the ManagedSoftwareUpdate.log file by running the command line below.  Note - the "-F" parameter means the tail command will continually monitor the file for updates (displaying progress as the software installation continues).
  2. Look for a line in the results stating Skitch version [version] (or newer) is already installed.   This indicates the software has been installed.
tail -n 20 -F /Library/Application\ Support/AirWatch/Data/Munki/Managed\ Installs/Logs/ManagedSoftwareUpdate.log

The VMware agent initiates a Managed Software Update within the munki framework multiple times.  Depending on where the agent is within the process of the install the tail command may output lines similar to the following:

[Date/Time]    Need to install Skitch
[Date/Time]    Downloading Skitch-2.8.1.dmg from Skitch-2.8.1.dmg
[Date/Time]    The following items will be installed or upgraded:
[Date/Time]         + Skitch-2.8.1
[Date/Time]      Processing installs
[Date/Time]      Installing Skitch (1 of 1)
[Date/Time]     Mounting disk image Skitch-2.8.1.dmg
[Date/Time]     The software was successfully installed.

5.7. Check for App in the Launchpad

  1. Click the Launchpad icon on the Dock
  2. Check for the existence of the Skitch application

6. Key Takeaways

  • macOS Applications can be deployed using the munki framework (Internal Application)
  • Detailed status on installation progress is delivered to the end-user via the Workspace ONE Intelligent Hub for macOS
  • Intelligent Hub provides an Application Catalog to allow user and device specific self-service requests for application installation
  • Intelligent Hub provides a command line interface (hubcli) that admins can use to configure hub settings and send notifications to the end-user

0 Comments

Add your comment

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.