Re-signing BMC MyIT for Apple iOS

The following process describes how to re-sign BMC MyIT so that you can deploy the mobile app to end users who use Apple iOS devices.

The process involves the following procedures:

Before you begin

You must be a member of the Apple Enterprise Program to obtain the required development tools from the Apple Developer Portal. See the following resources for more information:

  • Apple Enterprise Program application—Apple requires you to be a company or organization with a D-U-N-S number to apply. An enterprise account allows you to distribute the rebranded application internally. An organization account enables you to distribute applications through the Apple store only.
  • Apple Developer Portal—Contains the development tools and documentation for developing Apple iOS apps.
  • Managing Your Team—Describes how to assign appropriate team roles. To complete the following procedures, you must assign the Team Agent role to the user who will create the certificate.
  • Accessing Member Center and iTunes Connect—Provides information about certificates.

To install Xcode and the Apple root certificate

You are required to perform this procedure only once. You need Xcode developer tools to install the entitlements file as part of the re-signing process.

  1. On an Apple computer running MacOS, install the free Xcode from the App Store.
    Xcode cannot be used on an iPad, iPhone, or other iOS device.
  2. Install the Apple root certificate, as follows:
    1. Go to http://www.apple.com/certificateauthority/.
    2. Download the Apple Inc. Root Certificate.
    3. Double-click the file, and install it in the Keychain (login).

To create an enterprise distribution certificate to re-sign BMC MyIT

You will use this certificate to sign the BMC MyIT iOS application.

  1. Log on with the Team Agent role to the iOS Provisioning Portal at https://developer.apple.com/devcenter/ios/index.action.
  2. In the Certificates section, click the plus sign (+) to add the certificate.
  3. In the Production section, select In-House and Ad Hoc.
  4. Generate a certificate signing request (CSR) by using the Certificate Assistant.
    Follow the instructions that Apple provides on the CSR screen.
  5. Upload the CSR to the iOS Provisioning Portal, and download the distribution certificate.
  6. Save the certificate, and open it with the Key Chain Access application.
  7. To export the certificate to a different build, save it in .p12 format:
    1. In Key Chain Access, go to the My Certificates section.
    2. Right-click the downloaded certificate, and click Export.
    3. Save the certificate in .p12 format, and provide a secure password when required.

To create an application ID for your signed version of BMC MyIT

  1. Log on with the Team Agent role to the iOS Provisioning Portal.
  2. In the Identifiers section, click the App IDs tab.
  3. Click the plus sign (+) to add a new identifier.
  4. In the Description field, type a name that will easily identify your application to you within the portal (for example, Calbro MyIT).
  5. Make a note of the App ID Prefix (Team ID), which you will use in the re-signing process.
  6. Select Explicit App ID, and enter a unique identifier in the Bundle ID field (for example, com.customername.MyIT).
  7. Make a note of the Bundle ID for the re-signing process.
  8. In the App Services section, leave the default values, and ensure that Push Notifications is selected.
  9. Click Continue.
  10. Click Done to return to the Identifiers list.

To create an in-house distribution provisioning profile

You need this profile to deploy the BMC MyIT mobile application to your organization.

  1. Log on with the Team Agent role to the iOS Provisioning Portal.
  2. In the Provisioning section, click the Distribution tab.
  3. Click the plus sign (+) to add a new profile.
  4. On the Create iOS Provisioning Profile page, complete the following steps:
    1. For the Distribution Method, select In House.
    2. Select the distribution certificate that you created.
    3. Select the application ID that you created in To create an application ID for your version of BMC MyIT.
  5. Download the provisioning profile.

To create an Apple Push Notification Service (APNS) certificate

You need this certificate, so that the mobile application can receive notifications.

  1. Log on with the Team Agent role to the iOS Provisioning Portal.
  2. In the Certificates section, click the Production tab.
  3. In the top-right corner, click the plus sign (+).
  4. Select Apple Push Notification Service SSL (Production).
  5. Select the App Prefix ID (Team ID) that you created.
  6. Generate a certificate signing request (CSR) by using the Certificate Assistant.
    Follow the instructions that Apple provides on the CSR screen.
  7. Double-click the certificate to download it and import it into your Keychain.

To re-sign the BMC MyIT mobile application with your enterprise credentials

You are now ready to re-sign the mobile application. You will work with the BMC MyIT.ipa file.

  1. In the terminal application, unzip the MyIT.ipa file by entering the following commands. Replace /path/ with a specific path on your system; for example, /User/bill/MyIT-working/.

    mkdir /path/MyIT-ResignDir
    cd /path/MyIT-ResignDir
    unzip –oq /path/MyIT.ipa
  2. Clear out the previous build files, by entering the following commands:

    rm -rf "$(getconf DARWIN_USER_CACHE_DIR)/org.llvm.clang/ModuleCache"
    rm -rf ~/Library/Developer/Xcode/DerivedData
    rm -rf ~/Library/Caches/com.apple.dt.Xcode
    
  3. Re-sign the swift code dylibs with the following script.

    #!/bin/sh
    
    # Usage: ./sign.sh INPUT.ipa OUTPUT
    PROVISION.mobileprovision IDENTITY_NAME ENTITLEMENTS
    # Example
    # ./sign.sh MyServices.ipa MyServices myprofile.mobileprovision "iPhone Distribution: BMC Software, Inc (A8S3FFXTKS)”
    
    # Reading parameters
    INPUT=$1
    OUTPUT=$2.ipa
    MOBILE_PROVISTION=$3
    CER_NAME=$4
    
    # ENTITLEMENTS=$5
    
    # Cleaning working env
    rm -r Payload SwiftSupport
    
    # Unpackaging app
    unzip -q $INPUT
    APP=`ls Payload | tail -1`
    
    # Replacing mobile provision
    echo "Deleting original
    embedded.mobileprovision"
    rm "Payload/$APP/embedded.mobileprovision"
    echo "Copying embedded.mobileprovision"
    cp "$MOBILE_PROVISTION" "Payload/$APP/embedded.mobileprovision"
    
    # Resigning ipa
    echo "Re-sign by $CER_NAME"
    
    # Resigning dylibs
    if [ -e Payload/$APP/Frameworks ]
    then
      for dylib in "Payload/$APP/Frameworks/*"
      do
        codesign -f -s "$CER_NAME" $dylib
      done
    fi
    
    # Resigning app
    codesign -f -s "$CER_NAME" "Payload/$APP"
    
    # Cleaning output env
    rm -r "$OUTPUT"
    
    # Packaging ipa
    echo "Packaging ipa"
    zip -qr "$OUTPUT" Payload
    echo "Re-signed ipa $OUTPUT"
  4. In Xcode, create a MyIT.entitlements file in the /path/MyIT-resign-ipa directory, and add the following lines. You can download a copy of MyIT.entitlements to use as a starting point.

    MyIT.Entitlements file
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
    	<key>application-identifier</key>
    	<string>ABCDE-ID.com.bmc.bsmapps.MyIT</string>
    	<key>aps-environment</key>
    	<string>production</string>
    	<key>get-task-allow</key>
    	<false/>
    	<key>keychain-access-groups</key>
    	<array>
    		<string>ABCDE-ID.com.bmc.bsmapps.MyIT</string>
    	</array>
    </dict>
    </plist>
  5. In the sample entitlements file, perform the following actions:

    • Replace the value for the application-identifier key with your team prefix and App ID.
      For example, replace ABCDE-ID.com.bmc.bsmapps.MyIT with TEAMBUNDLEID.com.companyName.MyIT.

    • Replace the the keychain-access-groups key value with your team prefix and App ID.
      For example, replace ABCDE-ID.com.bmc.bsmapps.MyIT with TEAMBUNDLEID.com.companyName.MyIT.

  6. Perform the steps to customize the visual design. For instructions, see Rebranding BMC MyIT iOS client.
  7. Place the provisioning profile that you created into the /path/MyIT-ResignDir folder , and rename the file to MyIT.mobileprovision. For instructions, see Creating your in-house distribution provisioning profile for details about creating your own provisioning profile.
  8. Navigate to the /path/MyIT-ResignDir folder.

    cd /path/MyIT-ResignDir
    
  9. From the /path/MyIT-ResignDir folder, perform the following actions:
    1. Set the bundle ID (see the Apple Developer Site for more information), where CompanyDomain is your domain in reverse DNS format (for example, com.acme), and MYIT-APPNAME is the unique internal application name for BMC MyIT (for example, MyIT-Acme):

      /usr/libexec/PlistBuddy -c "Set CFBundleIdentifier CompanyDomain.MYIT-APPNAME" ./Payload/MyIT.app/Info.plist
    2. Set the application name displayed on the iOS devices, where ApplicationName is the name of your MyIT application (for example, MyIT or AcmeMyIT):

      /usr/libexec/PlistBuddy -c "Set CFBundleDisplayName ApplicationName" ./Payload/MyIT.app/Info.plist
    3. Set the default BMC MyIT server to your BMC MyIT server, where SERVER is your BMC MyIT server name (for example, MyIT.acme.com):

      /usr/libexec/PlistBuddy -c "Set myit-server SERVER" ./Payload/MyIT.app/Info.plist
    4. Set the default port for your BMC MyIT server, where PORT is the TCP port for clients to access the server (for example, 80 or 443):

      /usr/libexec/PlistBuddy -c "Set myit-port PORT" ./Payload/MyIT.app/Info.plist
    5. Replace the mobile provision file as shown in the example:

      cp "MyIT.mobileprovision" "./Payload/MyIT.app/embedded.mobileprovision"
    6. Remove the the BMC code signature as shown in the example:

      rm -r "./Payload/MyIT.app/_CodeSignature" "./Payload/MyIT.app/CodeResources"
    7. Issue the following command to re-sign the IPA. Replace BMC Software, Inc. with the name of your organization.

      /usr/bin/codesign -f -s "iPhone Distribution: BMC Software, Inc." --entitlements “./MyIT.entitlements" "./Payload/MyIT.app"
  10. Create the IPA zip file as shown in the example:

    zip -qr "MyIT-rebranded.ipa" Payload

To replace the BMC MyIT APNS certificate with your APNS certificate

After you complete this procedures, any notifications to iOS devices from your server (or tenant in multitenant environments) are sent using the new certificate.

  1. Log on to the server that hosts the BMC MyIT server.
  2. Stop the Apache Tomcat instance that executes the BMC MyIT server.
  3. Find the external-conf folder under the Tomcat home folder.
  4. Create a subfolder called certification.
  5. Place the p12 file containing your APNS certificate, which you created in To create an enterprise distribution certificate to re-sign BMC MyIT, into the certification subfolder.
  6. Log on to the Oracle or Microsoft SQL database used for BMC MyIT.
  7. Go to the PUSH_NOTIFICATION_CERT table, and query for records. 
  8. If you are changing the iOS APNS certificate, perform the following actions:
    1. In the iOS_Cert field, replace the current value with the name of the p12 file that contains your new APNS certificate. The default value is BMCiOSAPNSMyITMobile.p12.
    2. In the iOS_Password row, replace the current password with the password of your p12 file. Enter the password in plain text.
  9. Click Save
  10. Start the Tomcat instance.

Where to go next

Updating the server location in the Apple iOS client for BMC MyIT

Related topics

Rebranding BMC MyIT for Apple iOS

Deploying BMC MyIT to your users

Was this page helpful? Yes No Submitting... Thank you

Comments