Windows devices are enrolled through the inbuilt application of the respective device, i.e Company app on Windows 8.0 , Workplace on Windows 8.1 and Work Access on Windows 10. The endpoints it triggers cannot be altered as required by the service developer. Therefore additional server configurations are required to manage Windows devices using WSO2 IoTS.
For more information, see Windows Server Configurations.
The high level message flow of a Windows device is shown in the below diagram. The Windows device sends requests to a Proxy server that then directs the requests to the WSO2 IoT Server.
How it works
Step 1: Initiate the enrollment process
When a user signs in through the Workplace application using a Windows device, the user's email address needs to be provided as shown below:
The email address is provided in the following format:
- The automatic discovery service of the device uses the following fields and constructs a unique URI:
- Append the subdomain
- Extracts and append the domain from the username, i.e
<EMAIL_DOMAIN>, that was submitted when signing in.
- Append the path
The constructed URI will take the following format:
Example: If the given user name is
firstname.lastname@example.org resulting URI would be
- Append the subdomain
- The constructed URI will then be used to initiate the enrollment process of the mobile device.
Step 2: Proxy endpoint 01
The first Proxy endpoint known as the
Discovery Service Endpointreceives the initial request from the device.
The initial request from the device is a standard
The received request is redirected by the Proxy Server to MDM endpoint 01 at the server end.
GETrequest helps the device to check if the server is up and running.
- Once a success message is returned to the device by MDM endpoint 01, It will move to the next step.
Step 3: MDM endpoint 01
- This endpoint receives the initial
GETrequest that was redirected by the Proxy Server. It then returns a success response to the device.
- When the endpoint receives the success message from the server, the device triggers a
HTTPS POSTrequest to the same proxy endpoint (Proxy endpoint 01) .
The Proxy Server redirects the request to MDM endpoint 02, which is at the server side.
Step 4: MDM endpoint 02
- Once the
POSTrequest from the device is received at this endpoint, the MDM server will include the following details within a response body and send to the device.
- If Requested user device is Windows 8/8.1 one, user gets 3.a proxy endpoints for the response of the POST request, But If its a Windows 10 Device, He/She gets 3.b proxy endpoint.
1. Authentication Policy.(Federated)
2. Proxy endpoint for the Enrollment policy. (
/ENROLLMENTSERVER/PolicyEnrollmentWebservice.svc) - Proxy endpoint 02.
3. a. Proxy endpoint for the Enrollment Service. (
/ENROLLMENTSERVER/DeviceEnrollmentWebservice.svc) - Proxy endpoint 03 ab. Proxy endpoint for the Enrollment Service. (
/ENROLLMENTSERVER/Win10DeviceEnrollmentWebservice.svc) - Proxy endpoint 03 b4. Proxy endpoint for the Windows login page. (
/windows-web-agent) - Proxy endpoint for the federated login page.
First of all device receive proxy end point for federated login page as following:
- After receiving the above responses, the device requests are made in the following order:
The device requests for the login page using the proxy endpoint URL. The proxy server will then route the request to the following IoTS endpoint.
- Next the device sends a request to Proxy endpoint 2 and 3 respectively.
Step 5: Proxy endpoint 02This Proxy Server routes the messages to MDM endpoint 03.
Step 6: MDM endpoint 03
MDM Endpoint 3 responds back to the device with the Certificate Enrollment Policy.
The Certificate Enrollment Policy is an implementation of the MS-XCEP 509 protocol.
Once the certificate enrollment policy is received, the device sends the Certificate Signing Request (CSR) to Proxy endpoint 03.
Step 7: Proxy endpoint 03. a
Step 8: Proxy endpoint 03. b
This Proxy Server routes the message received from MDM endpoint 03 b. to MDM endpoint 04.b
Step 8: MDM Endpoint 04. a
- The service corresponding to this endpoint generates the signed certificate for the Certificate Signing Request and provide next enrollment Proxy endpoint Proxy Endpoint 4.a
- It then responds to the device with an encoded
wap-provisioning.xmlfile, which includes necessary certificates and other Device Management information.
The certificate enrollment is an implementation of the
The initial details provided through the
POST request are used to persist the device details in the database.
Step 8: MDM Endpoint 04. b
- The service corresponding to this endpoint generates the signed Certificate for the Certificate Signing Request and Enroll the Windows 10 devices against the IOT server and provide the get pending Proxy endpoint Proxy Endpoint 4.b
Step 9: Proxy Endpoint 04. a
This Proxy Server routes the message received to MDM endpoint 05.
At the end of this flow Device is enrolled successfully.
Step 9: Proxy Endpoint 04. b
This Proxy Server routes the message received to MDM endpoint 06.
Step 10: MDM Endpoint 05
Step 10: MDM Endpoint 06
This endpoint will handle all the device management requests and responses.
The protocol that is being used is SyncML v1.2.