Zenworks mobile management activesync with datasynchronizer

Question

Can I point zenworks mobile management server at the datasynchronizer as an activesync for auto enrolment?

Answer 1

Georg,
Option A seems to work reliably today with Exchange 2007 so as long as the DataSync team properly implements the settings request for email address provided in the ActiveSync 12.1 protocol then it should work reliably. As for B today if the device doesn't support 12.1 or the server doesn't support 12.1 as is the case right now the only approach we currently have is to strip off the domain from the email address and attempt authentication as the user specified in the email. We are working to see if there is some other approach we can take once we provide additional LDAP enhancements in the next version of the product. But for now the two options you identified in our long term solution are the knowns. I'll forward this thread on to both the DataSync team and the ZMM development team and see if we can all come up with some better ideas.
Thanks,
Jason
>>> Georg Fritsch<[email protected]> 8/9/2012 1:24 PM >>>
Hi Jason,
Thanx again for the detailed and competent anwser.
All this restrictions unfortunately mean that hands-off enrollment is going
to fail for many setups. (including us)
A requirement that the local-part of an email address has to match the
username is ridiculous. (Yes, we all know that Exchange 2003 and ActiveSync
2.5 are ****...)
I am not sure if understand the long term solution:
A) If a user gives just a username, the device must get the corresponding
email address from the ActiveSync system. Available with protocol version
12.1. Fine. (As long as the device uses protocol version 12.1)
B) A user gives an email-address, the username must be derived from the
local-part. Where/How?, local-part == username is an invalid assumptionand
the device does the parsing and just returns the local-part as username to
the ActiveSync system. (And this information is IMO not enough to find the
real username)
Or is B) not allowed (or a really bad idea/design decision) as A) does
reliably work?
Georg
>>> Jason Blackett<[email protected]> schrieb am 09.08.2012 um 05:35 in
Nachricht <[email protected]>:
> The problem with 1.2.3 is that when you authenticate to the domain with
> the following credentials:
>
> user : bob
> domain : m.comp.com
> server : zmm.comp.com
>
> That the ZMM product currently relies on the activesync provider to tell
> it Bob's email address. If it doesn't receive one then the iOS active
> sync account it creates ends up with an email address of
> m.comp.com\[email protected] which seems to work fine for getting
> email/calendar but not for sending email. This only occurs if you do
> hands-off enrollment because as TASNovell points out the email address
> attribute doesn't get populated in the user, but is a required field when
> creating a user.
>
> The ActiveSync way to fix this is that ActiveSync has to allow the user
> to authenticate with their email address [email protected] for instance. And
> then when it parses that it sends back the username as bob and uses the
> full email address. This is the same capability provided by Microsoft
> Exchange 2003 which implements the same version of ActiveSync as DataSync
> currently. There definitely will be issues if the username portion of the
> email address is not the ActiveSync user account name. In that case hands
> off enrollment will fail and you will have to manually create the account
> or import it from the directory and set the email address attribute.
>
> The long term solution is that DataSync will move to the 12.1 version of
> the ActiveSync protocol which provides a settings call that the agent can
> make to retreive the email address from the ActiveSync system if the user
> didn't provide one. However this is going to take some time. So in the
> short term the datasync team implemented the Exchange 2003 like
> capability allowing user authentiction with email address and then
> parsing the username. This capability will be part of 1.2.4. This issue
> is documented in the ZMM Server Release notes
> (http://www.novell.com/documentation/.../zen_mobile_se
> rver_relnote.pdf) as follows:
>
> "12. Systems where iOS users are interfacing with a Novell GroupWise
> DataSync server must use
> DataSync Update 4 (Mobility 1.2.4) to fully utilize the hands-off
> enrollment functionality. Users need to
> enroll using their entire email address in lieu of their username if
> they are enrolling by the hands-off
> method. Similar processes must be followed to use hands-off enrollment
> when users interface with
> Exchange 2003 or any other mail server running ActiveSync 2.5 protocol.
> A user's username and the
> string of characters to the left of the @ sign in their email address
> must be the same."
>
> Jason
>
>>>> TASNovell<[email protected]> 8/9/2012 8:26 AM >>>
>
> feeling a bit silly not reading the version number. We are running
> datasync v1.2.3.3xxx. ZMM seems to connect fine. Email flows correctly
> to the ios devices through the delivered profile. The only thing that is
> not imported is the email address into the newly created user in ZMM. I
> assume this should be pulled through from LDAP as you have to set the
> attribute up during install.