To ensure reliable check out, your devices must check in reliably. This page is intended to document Imprivata’s recommendations for a reliable check in experience. Your Check In workflow must contain the following actions, at a minimum: Perform MDM Command: Clear Passcode Check In Device Launch App for com.apple.webapp On Failure: Retry 3x Every Apple DEP workflow will additionally include … Read More

The Check In Device workflow action will launch the Imprivata Locker app, and lock the phone. The action supports several options. App Version The version of Imprivata Locker to lock. This should be set to “Locker 3 VPP” for most customers. Logout Actions Before locking the device, GroundControl can perform one or more actions on the device to log out of … Read More

Once you’ve set up, tested and automated your check out workflows and also validated your environment is supports Password AutoFill,  you’re ready to get started. Password AutoFill is available only when Admin > Check Out > Identity Provider is set to “Imprivata OneSign”. Set up AutoFill in GroundControl Two Factor Authentication is needed for Password AutoFill, but not for device … Read More

iOS apps require a profile to feed usernames and passwords from Imprivata OneSign. This is similar to all other apps in the OneSign system. OneSign’s method for creating profiles with the Application Profile Generator (APG) does not work for mobile applications, therefore a new method is required in order to achieve the same results. Profiles are simple XML documents. With … Read More

Our Check Out feature requires customers to connect to a web service to handle the translation of badge IDs to user IDs. This document describes how to integrate with Imprivata OneSign for identity lookup. If you don’t have Imprivata OneSign, you may use a custom identity lookup service, described in a separate article. Prerequisites You already followed the Check Out setup … Read More

Like library books, checked-out devices that aren’t returned by a certain date can become overdue, and notify you or the user that a device hasn’t been returned yet. Enabling Overdue Devices The control to enable this feature  is in Admin > Check Out. When enabled, a configuration dialog will appear. Here, you can customize the number of hours and minutes … Read More

GroundControl usually hides devices as soon as they are unplugged. But you may wish to have an easy way to list checked out devices, in order to identify the users at any given moment. GroundControl allows the display of checked out devices in three ways: In the Admin console, within the Launchpad detail In the Launchpad display On the device … Read More

Like GroundControl, VMware Workspace ONE (aka “AirWatch”) includes features for shared device checkout. This article explains how to link GroundControl with Workspace ONE, so that the checkout features are synchronized between the two systems. Once linked, a checkout in GroundControl — via a proximity badge tap, for example — will assign the device to the user in your MDM. This … Read More

GroundControl keeps a history of which user checked out the device at which time. GroundControl also records when the user returned the device. The device does not need to be connected to a Launchpad to view this activity. In the GroundControl admin console, click on the Devices tab. Search for the device name or serial number. Once you locate the … Read More

GroundControl includes a simple web app simulating a Pinpad for authentication. Obviously this system is not secure, and should never be used in production. We encourage you to browse the source code for the web app. It’s a good demonstration for using OAuth to authenticate against GroundControl, and for using the GroundControl APIs to check out devices. In the GroundControl … Read More