This documentation is for WSO2 Enterprise Mobility Manager 2.2.0. View documentation for the latest release.
Windows Configurations - Enterprise Mobility Manager 2.2.0 - WSO2 Documentation
Skip to end of metadata
Go to start of metadata


The EMM client sends requests to the EMM server through a Proxy Server. The Windows EMM protocol constructs a URI that uses the host name by appending the domain of the email address to the subdomain enterpriseenrollment, for the each device request. Therefore you can either purchase a domain name or create a DNS entry in the  http://enterpriseenrollment.<EMAIL_DOMAIN> format.

Example: Discover the EMM server by sending a request through: http://enterpriseenrollment.<EMAIL_DOMAIN>/EnrollmentServer/Discovery.svc.

As the EMM server can not create Windows service endpoints it is advisable to use a proxy server between the device and the EMM server. 

When using a proxy server, it redirects the device requests to the EMM server endpoints. As the proxy directly contacts the EMM server you need to configure the SSL Configuration to maintain a secure message flow.

Please refer the Windows Device Enrolment Process Message Flow to identify the message flow from a Windows mobile device to the WSO2 EMM Server through the Proxy Server.

Configure the Proxy server

Any preferred server can be used as a proxy server between the device and the EMM server. The steps documented below is only an example of configuring the proxy server by using the Apache2 HTTP Server. The Apache Server can be configured using the forward or reverse proxy (also known as gateway) mode. The reverse proxy mode is used to configure Apache2. You can download the Apache2 HTTP Server from here.

Follow the steps given below to configure the proxy Server:

Step 1: Configure reverse proxy

A reverse proxy (or gateway) appears to the client like an ordinary web server with no special configuration required for the client. Ordinary requests for content is made by the client through the name-space. The reverse proxy redirects the requests, and returns the required output.

The following modules are required to configure the reverse proxy:

    This module deals with proxying in Apache.

    This module handles connections with both the HTTP and HTTPS protocols.

  1. Navigate to the etc/apache2 directory and use the following command to enable the above modules:

    cd /etc/apache2
    a2enmod proxy_http
  2. Configure the proxy.conf file that is in the /etc/apache2/mods-available directory by including the configurations given below to the end of the file.

    ServerName localhost
    ProxyRequests off
    ProxyPreserveHost off
      <Proxy *>
      Order deny,allow
      #Deny from all
      Allow from all    
    ProxyPass /ENROLLMENTSERVER/PolicyEnrollmentWebservice.svc http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/services/certificatepolicy/xcep
    ProxyPassReverse /ENROLLMENTSERVER/PolicyEnrollmentWebservice.svc http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/services/certificatepolicy/xcep
    ProxyPass /ENROLLMENTSERVER/DeviceEnrollmentWebservice.svc http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/services/deviceenrolment/wstep
    ProxyPassReverse /ENROLLMENTSERVER/DeviceEnrollmentWebservice.svc http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/services/deviceenrolment/wstep
    ProxyPass /Syncml/initialquery http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/services/syncml/devicemanagement/request
    ProxyPassReverse /Syncml/initialquery http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/services/syncml/devicemanagement/request
    ProxyPass /ENROLLMENTSERVER/ONPREMISE/PolicyEnrollmentWebservice.svc http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/services/certificatepolicy/xcep/onpremise
    ProxyPassReverse /ENROLLMENTSERVER/ONPREMISE/PolicyEnrollmentWebservice.svc http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/services/certificatepolicy/xcep/onpremise
    ProxyPass /ENROLLMENTSERVER/ONPREMISE/DeviceEnrollmentWebservice.svc  http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/services/deviceenrolment/wstep/onpremise
    ProxyPassReverse /ENROLLMENTSERVER/ONPREMISE/DeviceEnrollmentWebservice.svc  http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/services/deviceenrolment/wstep/onpremise
    ProxyPass /emm-web-agent http://<server-ip>:<server-port>/emm-web-agent
    ProxyPassReverse /emm-web-agent http://<server-ip>:<server-port>/emm-web-agent

    The default <server-ip>:<server-port> is localhost:9443.

Step 2: Configure the Rewrite engine

The first GET and POST HTTP requests are received by the same MDM endpoint and the rewrite conditions filter the device requests. By default the Apache Rewrite engine is disabled.

Follow the steps given below to enable the Rewrite engine when running on Ubuntu:

  1. Invoke the rewrite rules:
    1. Create a .htaccess file in the /var/www/ directory with the specific rewrite rules.
    2. Enable the mod_rewrite module.

      sudo a2enmod rewrite
  2. Configure the 000-default file, which is in the /etc/apache2/sites-enabled directory.

    This step is required to replicate the configuration changes required in the Apache versions on a few files.In the older Apache versions, all virtual host directory directives were managed in the apache2.conf file, which is in the /etc/apache2 directory. In the Apache 2.4.7 version this has changed and the alterations are handled within the /etc/apache2/sites-enabled directory.

    1. Configure the value assigned to AllowOveride from None to All under <Directory/>.

      AllowOverride All
    2. Configure the content under <Directory /var/www/>.

      If the 000-default file does not contain the Directory tag you need to add it to the file as shown below:

      <Directory /var/www/>
       Options Indexes FollowSymLinks MultiViews
       AllowOverride all
       Order allow,deny
       allow from all
  3. Restart the Apache server.

    server.sudo service apache2 restart
 Click here to see the Rewrite Engine Configuration file format
Rewrite Engine Configuration file format
RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(GET)$
RewriteRule /EnrollmentServer/Discovery.svc   http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/services/discovery/get [P,L]

RewriteCond %{REQUEST_METHOD} ^(POST)$
RewriteRule /EnrollmentServer/Discovery.svc http://<server-ip>:<server-port>/api/device-mgt/windows/v1.0/services/discovery/post [P,L]

The default <server-ip>:<server-port> is localhost:9443.

Step 3: SSL configurations for Apache2

An SSL certificate is used to encrypt the information of a site and create a secure connection.

Follow the steps given below to configure SSL for Apache2:

SSL support is available as a standard on the Ubuntu 14.04 Apache package.

  1. Enable the SSL Module.

    sudo a2enmod ssl
  2. Create a subdirectory named ssl within the Apache server configuration hierarchy to place the certificate files.

    sudo mkdir /etc/apache2/ssl

    The EMM certificate must be generated from a trusted authority.

    Once you have the EMM certificate and key available, configure the Apache server to use these files in a virtual host file. For more information, see how to set up Apache virtual hosts.

  3. Configure the default-ssl.conf file, which is in the /etc/apache2/sites-enabled directory contains the default SSL configurations.

    SSLEngine on
    SSLCertificateFile    /etc/apache2/ssl/<COMAPNY_CERTIFICATE>
    SSLCertificateKeyFile /etc/apache2/ssl/<COMPANY_PUBLIC_KEY>
    SSLCACertificateFile /etc/apache2/ssl/<COMPANY_ROOT_CERTIFICATE>


    SSLEngine on
    SSLCertificateFile    /etc/apache2/ssl/star_wso2_com.crt
    SSLCertificateKeyFile /etc/apache2/ssl/star_wso2_com.key
    SSLCACertificateFile /etc/apache2/ssl/DigiCertCA.crt
  4. Enable the SSL-enabled virtual host that you configured in the above step.

    sudo a2ensite default-ssl.conf
  5. Restart the Apache server to load the new virtual host file.

    sudo service apache2 restart

You are not required to perform any additional steps to configure the Windows client.

What's next

  • No labels