07. Administration

EBF Files server allows simultaneous access to multiple file sources on a mobile device. Access and interaction of these sources (called containers) is configurable by a simple to use administrative interface.

The containers or folders from various file systems are defined in the portal and then assigned to corresponding users. The following sections explain the administration role within the Admin Portal as well as the configurability of the mobile EBF Files application.

Permissions

The following diagram illustrates multi-tenant and/or multi-domain capacity of EBF Files server:

There are 3 different admin permission levels:

• Tenant Administrator
  Users are defined by configuration from an admin LDAP server and can:
  • Create organizations
  • Add domains to organizations
  • Create containers
  • Create domain designs
  • Assign groups to containers
• Organization Administrator
  Users are again defined by configuration coming from the admin LDAP server:
  • Add domains to organizations
  • Create domain designs
  • Create containers
  • Assign groups to containers
• End User
  • No EBF Files Server Admin Portal access
  • Container access through the EBF Files App

A tenant administrator can define multiple organizations representing for example different organizational branches.

Each organization, a tenant or organization administrator defines at least one domain that represent for example departments. Email suffix is used to identify the domain when the client logs on to the EBF Files server.

It is possible to define different settings and possibly branding for the client for each domain. The settings default from the organization.

For each domain the administrator can define containers. Each container contains independent settings and associated end user groups. Supported container types are:

• SharePoint 2019 on Premise
• SharePoint 2016 on Premise
• SharePoint Online
• Files Sharing
• Files Sharing (Home Folder)

Settings

After first login to the EBF Files Server Admin Portal, you will be redirected to the settings page where you can search for AD groups of SUPERADMIN and TENANTADMIN.

Admin group(s) that will be set here, will be responsible for creating or updating organizations and domains.

IMPORTANT: Any admin who is not a member of the created group(s) will not be able to login to the web portal (be sure to put all needed groups).

After saving, you will be asked to login again (to get a new token).

Organizations

First create an organization:

Organizational settings act as defaults for the technical domains created under the organization level. The default (or edited) technical domains are containers within the mobile application. Assign a unique name for the organization:

Define the app appearance for the named organization:

The configuration defines the application appearance with the following roles and capabilities:

If you already have an organization as .json file you can import it.

Please check the assigned AD groups in the organisation/domain after import and adjust them as needed. This is important to keep them accessible for admins for later maintenance.

Domains

The technical domain is created in a 2-step process, first create a domain:

Next define the user administration associated with this domain:

You can configure the domain in this way:

Defined the default appearance and allowed actions within the EBF Files app, defaults come from the organization:

IMPORTANT: Any admin member of AD group can view or edit this domain. Admins from a different group will not see this domain.

Click „Save“ to assign domain configurations for the Admin Portal.

If you have already a domain as .json file you can import it.

Please check the assigned AD groups in domain after import and adjust them as needed. This is important to keep them accessible for admins for later maintenance.

Containers

After creating a domain group, domain admins members can create containers. These containers are available in the EBF Files application for the appropriate user groups. These containers can be additionally restricted in scope of use according to the settings in the container configuration.

The following data container types can be created.

• OneDrive4Business
• Sharepoint
• FileShare

The container data protection types:

• Public (0)
• Internal (1)
• Confidential (2)
• Strict Confidential (3)

Data protection is applied when user want to copy/move a (file or folder) from one container to another.
those actions are possible only if the destination container has same data protection type or upper.
Example:

• Container A has “Public” as data protection.
• Container B has “Confidential” as data protection.

User who use Container A can copy/move to Container B, but user using Container B can copy only to the same container B.

OneDrive4Business

Create a container after selecting the company organization and corresponding technical domain:

First select the container type:

Next define the following:

• Name of the container in the EBF Files app
• Application ID from O365 for OneDrive Cloud: The Application ID is described on the following page:
  Create an app with Microsoft Graph – OneDrive API – OneDrive dev center
  Please make sure, the Application ID has the permissions required by EBF Files (see below).
• In case of OneDrive on-premise enter the server URL in the corresponding field

Finally define:

• User groups allowed to use the container in the EBF Files app
• Container appearance
• Interactions allowed in container

Click „Save“ to release use of the container in the app.

SharePoint

EBF Files can be associated MS SharePoint pages. Accessing pages from SharePoint O365/2013/2016/2019 is supported.

After selecting a company organization and corresponding technical domain a container can be created:

First select container type „SharePoint“ and version:

• SharePoint Office 365
• SharePoint On-Premise

Next define the following:

• Name of the container in the EBF Files app

• Application ID from O365 for SharePoint Cloud: The Application ID is described on the following page:
  Create an app with Microsoft Graph – OneDrive API – OneDrive dev center
  Please make sure, the Application ID has the permissions required by EBF Files (see below).

• In case of SharePoint on-premise enter the server URL in the corresponding field

Additional settings for the new Sharepoint container need to be provided:

File Share

Click „Save“ to release the container for use in the app.

The container type „File Share“ provides corresponding file server directories as containers within the EBF Files app.

The following options are available:

• Home Directories
• Share

With „Home Directory“ the user’s home directories from Active Directory can be represented as containers within the EBF Files app, while the „Share“ container allows file server based folders to be exposed as containers.

Select a company organization and a corresponding technical domain:

The first step as an example is to select container type „File Share“:

Now choose between Share or Home Directory.

For „Home Directory” configure the following:

If „Share“ is selected, the following configuration applies:

For the File Server Path variables from LDAP can also be used (example: /Files-Share$/{sAMAccountName}). The LDAP field name must be written in brackets and can be used in any place in the path. Currently supported fields are:

• name
• mail
• DN
• firstName
• lastName
• displayName
• phone
• UUID
• uid
• sAMAccountName
• UserPrincipalName

You need to complete the connection settings:

Click „Save“ to release the container for use in the app.

Integrating EBF Files with UEM Systems

Connect the EBF Files app to the EBF Files server either with:

• Direct access to the EBF Files server, if necessary with VPN. A VPN needs to be set up separately according to UEM vendor recommendations.
• Access via an UEM gateway to the EBF Files Server. This is only available for MobileIron.

UEM compliance mechanisms can be used to secure the data connections of a mobile device, along with dynamic app configuration (like AppConfig) for app roll out and configuration.

App Config Parameters

Use the following key-value pairs in AppConfig or managed App configuration:

Optional additional fields are available:

Files Serverless Mode

The app configuration can be manually created and delivered to Files app in a Json format via UEM system, Files will parse the Json in order to create the containers.

App Configuration details

Here is an example of a Serverless Json configuration:

{
    "AppSettings": {
        "LicenseKeys": {
            "Polaris": "98h678as-2h11-1111-111l-daa4c67dddk"
        },
        "LocalDocumentSettings ": {
          "Activate": true,
          "AllowOpenIn": true
        },
        "PrimaryColor": "#000000"
    },
    "FileSystems": [
        {
            "ContainerId": 1,
            "ContainerName": "OneDrive Online",
            "ContainerType": "OneDriveOnline",
            "SecurityClass": 3,
            "ApplicationId": "450fdsaa-9800-330e-1111-1poj1egct6qw",
            "AllowedActions": {
                "ShowHiddenFiles": true,
                "ShowSystemFiles": true,
                "AllowCreate": true,
                "AllowUpdate": true,
                "AllowDelete": true,
                "AllowOpenIn": true,
                "AllowSharing": true,
                "AllowSync": {
                    "OnlyWifi": false,
                    "OnAppStart": false
                }
            }
        },
        {
            "ContainerId": 2,
            "ContainerName": "Sharepoint Online",
            "ContainerType": "SharePointOnline",
            "SecurityClass": 3,
            "ApplicationId": "450fdsaa-9800-330e-1111-1poj1egct6qw",
            "AllowedActions": {
                "ShowHiddenFiles": true,
                "ShowSystemFiles": true,
                "AllowCreate": true,
                "AllowUpdate": true,
                "AllowDelete": true,
                "AllowOpenIn": true,
                "AllowSharing": true,
                "AllowSync": {
                    "OnlyWifi": false,
                    "OnAppStart": false
                }
            }
        },
        {
            "ContainerId": 3,
            "ContainerName": "OneDrive OnPrem",
            "ContainerType": "OneDriveOnPrem",
            "ConfigContainerUsername": "username@domain.de",
            "SecurityClass": 1,
            "OnPremLink": "https://server-url.de",
            "AllowedActions": {
                "ShowHiddenFiles": true,
                "ShowSystemFiles": true,
                "AllowCreate": true,
                "AllowUpdate": true,
                "AllowDelete": true,
                "AllowOpenIn": true,
                "AllowSharing": true,
                "AllowSync": {
                    "OnlyWifi": false,
                    "OnAppStart": false
                }
            }
        },
        {
            "ContainerId": 4,
            "ContainerName": "SharePoint OnPrem",
            "ContainerType": "SharePointOnPrem",
            "ConfigContainerUsername": "username@domain.de",
            "SecurityClass": 0,
            "OnPremLink": "https://server-url.de",
            "AllowedActions": {
                "ShowHiddenFiles": true,
                "ShowSystemFiles": true,
                "AllowCreate": true,
                "AllowUpdate": true,
                "AllowDelete": true,
                "AllowOpenIn": true,
                "AllowSharing": true
            }
        }
    ]
}

ContainerType enumeration list

Here is the list of all container types accepted by the client application while parsing the configuration:

OneDriveOnline, SharePointOnline, OneDriveOnPrem, SharePointOnPrem.

Direct Connection

To roll out the app:

• Upload the app in the Enterprise App Catalog – Import from the Public Apple App Store (EBF Files)
• Store the AppConfig configuration

Settings and the app must be assigned to users and devices of a specific label or group.

MobileIron Secure Sentry Connection

To roll out the app with a Sentry connection:

• Upload the app in MobileIron Enterprise App catalog – import from the Public Apple App Store (EBF Files)
• Customize the Sentry configuration creating an „any Sentry“ service if not already present:
  
• Select or define the identity certificate (SCEP Setting) for connection to the Sentry
• Store AppConnect configuration
  

• Securing AppConnect apps within the AppConnect Policy: It may be necessary to include the app in the AppConnect Policy to enable collaboration with Email+ and other AppConnect enabled applications.

Settings and the app must be assigned to users and devices of a specific label or group.

Troubleshooting

EBF Files server creates and maintains logs, if activated in the configuration. An administrator with access to the machine can view the logs.
Application errors can be monitored generating device logs on the mobile device where the EBF Files app is running.

Gathering Files server log files

The logging detail level is stored in the fileserver.properties file:

logging.level.root=INFO

logging.level.de.ebf=DEBUG

logging.level.de.ebf.files.backend.LoggingFilter=DEBUG

logging.level.com.hierynomus.smbj=WARN

Levels are as follows:

The logs are available in the following machine folders, depending on the selected server installation variant:

• Appliance ISO Installation: var/log/files-server
• Docker based Installation: /usr/share/files/logs

Display log files (iOS) with macOS

1. Open the console on your macOS device.
   
2. Connect your device to the macOS device and reproduce the problem during the active log process.
3. Copy the logs into a text program and save them as a text file.

Display log files (iOS) with Windows

The tool „iOSLogInfo“ collects device logs of an iOS device over a Windows system.

Preconditions:

• Apple Windows iTunes application
• Access to Lightning USB interface of device

The tool is run from the command prompt on Windows computers to collect console logs.

1. Download the iOSLogInfo tool: From here
2. Use a compression app (e.g. Winzip) to extract the folder to any directory
3. Make sure the device is connected to the PC via Lightning cable
4. Click on “Start” and enter „CMD“. Right-click on the command prompt and select „Run as administrator“ as shown below
5. Navigate to iOSLogInfo (e.g. cd C:\iosloginfo) from the command prompt
6. The following command starts collection of iOS console logs:
   sdsiosloginfo.exe -d > c:\iosloginfo\consolelogs.txt
   

1. Perform actions on the iOS device, return to the command prompt and type “CTRL + C” to stop console logging
2. A .txt file named „consolelogs.txt“ has been created in the iOSLogInfo folder:
   

Note that iOSLogInfo provides many other features in addition to capturing iOS console logs.

A selection of additional commands:

Read console logs:

sdsiosloginfo.exe -d > C:\iOSLogInfo\consolelogs.log

Read crash logs:

sdsioscrashlog.exe -e -k C:\iOSLogInfo\crash_logs

Read memory allocation on the device:

sdsdeviceinfo.exe -q com.apple.disk_usage -x > C:\iOSLogInfo\iOS_Disk_Usage.xml

Read out device statistics:

sdsdeviceinfo.exe -x > C:\iOSLogInfo\iOS_Device_Stats.xml

Read iTunes logs:

sdsioscrashlog.exe -e -k C:\iOSLogInfo

Limitations

Restrictions for folders and files (SMB)

EBF Files server limitations primarily apply to the handling of directories and files within the server and corresponding application. For example, Microsoft Windows file restrictions apply to file operations within the application which are manifested in any respective containers.

• Directory and file names are not case sensitive
• Directory and file component names must not be longer than 255 characters
• Directory names cannot end with slash (/). If specified, it will be removed automatically
• File names cannot end with slash (/)
• Reserved URL characters must be encoded
• The following characters are not allowed: “ \ / : | < > * ?
• Invalid URL path characters are not allowed. Codes like \uE000 are valid in NTFS filenames, but not other Unicode characters. For example control characters (0x00 to 0x1F, \u0081, etc.) are not allowed. For the rules for Unicode strings in HTTP/1.1, see RFC 2616, Section 2.2: Basic Rules and RFC 3987
• The following file names referencing ports and destinations are not allowed: LPT1, LPT2, LPT3, LPT4, LPT5, LPT6, LPT7, LPT8, LPT9, COM1, COM2, COM3, COM4, COM5, COM6, COM7, COM8, COM9, PRN, AUX, NUL, CON, CLOCK$, dot (.), two dots (..)

Restrictions for working with files on Sharepoint

For EBF Files accessing Sharepoint files it is necessary, that library settings for each site are set to not require a checkout before editing.
This settings can be found in the site’s document library settings in the versioning page as shown below:

Supported file extensions

Files app supports a limited extension types (mime types) which are:

• MsWord (.doc,…)
• MsExcel (.xls, …)
• MsPowerPoint (.ppt,…)
• Pdf (.pdf)
• Audio (wide range of audio file extensions): Compatibility depends on the supported codecs of the OS.
• Image (wide range of image file extensions): Compatibility depends on the supported codecs of the OS.
• Text (.txt)
• Video (MOV, MP4): Compatibility depends on the supported codecs of the OS.