Permission denied error for NEFilterManager in Adhoc distribution

Hi,

I created content Filter Provider (DataProvider and ControlProvider) using below configuration, Everything was working as expectedly in development (saving FilterConfiguration where dataProvider and controlProvider processes are up and running), but when I tried to do the same in Adhoc distribution, NEFilterManager.shared().saveToPreferences failed with permission denied. On further investigation, I noticed below error in Console app from NEHelper


Sockets is the name of my app.

Sockets trying to create a content filter configuration through an app. Creating a content filter configuration is only allowed through profile in production version of Sockets.  

Code:-

let newConfiguration = NEFilterProviderConfiguration()
        newConfiguration.username = "userName"
        newConfiguration.organization = "Personal"
        newConfiguration.filterBrowsers = true
        newConfiguration.filterSockets = true
        NEFilterManager.shared().providerConfiguration = newConfiguration
        
        NEFilterManager.shared().isEnabled = true
        NEFilterManager.shared().saveToPreferences { error in
            if let saveError = error {
                NSLog("SocketsAPP : Failed to save the filter configuration: \(saveError)")
            }
            return
        }


I ensured that the device I am testing is supervised ( made it through apple configurator and displays that device is supervised in settings page).

Do ControlFilterProviders work on Ad-hoc distribution, or am I missing anything here?


Regards,

Ravi Teja Govinduluri

Answered by DTS Engineer in 398823022

On a supervised device you’re expected to configure your filter via a configuration profile. This makes sense when you think about it. This is a security feature on a supervised device; the device manager should be in charge of its configuration, not the user.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

ps DTS is closed 21 Dec through 1 Jan.

Accepted Answer

On a supervised device you’re expected to configure your filter via a configuration profile. This makes sense when you think about it. This is a security feature on a supervised device; the device manager should be in charge of its configuration, not the user.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

ps DTS is closed 21 Dec through 1 Jan.

Thanks, Eskimo, it really helped me. For more information, I have followed below two approaches

1) Created a configuration profile for third-party plugin web-content filter and pushed to my device through apple Configurator and after installing the profile, everything started working seamlessly

2) As an extension to approach to 1, created a web-server to push the configuration profile on the demand. Then I have requested the server through the app to provide the profile. I downloaded the profile and upon installation, everything started working.


I am planning to go through approach 2 and please let me know is it the correct way to do it/not.


As an extension, I also wanted to understand how would iOS behave when the device has more than one web content-filters?

I am planning to go through approach 2 and please let me know is it the correct way to do it/not.

I’m not really the right person to advise you about enterprise configuration issue.

As an extension, I also wanted to understand how would iOS behave when the device has more than one web content-filters?

My understanding is that it runs traffic through each of the filters (in an unspecified order) and blocks it if any of them block it.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

ps DTS is closed 21 Dec through 1 Jan.

Thanks for the details, it helped me

Permission denied error for NEFilterManager in Adhoc distribution
 
 
Q