Permission denied error for NEFilterManager in Adhoc distribution

Hi,

I created content Filter Provider (DataProvider and ControlProvider) using below configuration, Everything was working as expectedly in development (saving FilterConfiguration where dataProvider and controlProvider processes are up and running), but when I tried to do the same in Adhoc distribution, NEFilterManager.shared().saveToPreferences failed with permission denied. On further investigation, I noticed below error in Console app from NEHelper


Sockets is the name of my app.

Sockets trying to create a content filter configuration through an app. Creating a content filter configuration is only allowed through profile in production version of Sockets.  

Code:-

let newConfiguration = NEFilterProviderConfiguration()
        newConfiguration.username = "userName"
        newConfiguration.organization = "Personal"
        newConfiguration.filterBrowsers = true
        newConfiguration.filterSockets = true
        NEFilterManager.shared().providerConfiguration = newConfiguration
        
        NEFilterManager.shared().isEnabled = true
        NEFilterManager.shared().saveToPreferences { error in
            if let saveError = error {
                NSLog("SocketsAPP : Failed to save the filter configuration: \(saveError)")
            }
            return
        }


I ensured that the device I am testing is supervised ( made it through apple configurator and displays that device is supervised in settings page).

Do ControlFilterProviders work on Ad-hoc distribution, or am I missing anything here?


Regards,

Ravi Teja Govinduluri

Answered by DTS Engineer in 398823022

On a supervised device you’re expected to configure your filter via a configuration profile. This makes sense when you think about it. This is a security feature on a supervised device; the device manager should be in charge of its configuration, not the user.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

ps DTS is closed 21 Dec through 1 Jan.

Accepted Answer

On a supervised device you’re expected to configure your filter via a configuration profile. This makes sense when you think about it. This is a security feature on a supervised device; the device manager should be in charge of its configuration, not the user.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

ps DTS is closed 21 Dec through 1 Jan.

Thanks, Eskimo, it really helped me. For more information, I have followed below two approaches

1) Created a configuration profile for third-party plugin web-content filter and pushed to my device through apple Configurator and after installing the profile, everything started working seamlessly

2) As an extension to approach to 1, created a web-server to push the configuration profile on the demand. Then I have requested the server through the app to provide the profile. I downloaded the profile and upon installation, everything started working.


I am planning to go through approach 2 and please let me know is it the correct way to do it/not.


As an extension, I also wanted to understand how would iOS behave when the device has more than one web content-filters?

I am planning to go through approach 2 and please let me know is it the correct way to do it/not.

I’m not really the right person to advise you about enterprise configuration issue.

As an extension, I also wanted to understand how would iOS behave when the device has more than one web content-filters?

My understanding is that it runs traffic through each of the filters (in an unspecified order) and blocks it if any of them block it.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

ps DTS is closed 21 Dec through 1 Jan.

Thanks for the details, it helped me