RestrictionManager getRestrictions() is always empty

Question

I'm trying to set-up the remote configuration for my app with MobileIron EMM. I've done everything as described in developer guide: 1. I've set-up the manifest:

...
        <meta-data
            android:name="android.content.APP_RESTRICTIONS"
            android:resource="@xml/app_restrictions"/>
    </application>

2. I've described the restriction:

<?xml version="1.0" encoding="utf-8"?>
<restrictions xmlns:android="http://schemas.android.com/apk/res/android">
    <restriction
        android:title="@string/some_title"
        android:key="SOME_KEY"
        android:restrictionType="string"
        android:defaultValue="123"/>
</restrictions>

3. I'm trying to receive it as following:

RestrictionsManager manager = (RestrictionsManager) context.getSystemService(Context.RESTRICTIONS_SERVICE);
        Bundle b = manager.getApplicationRestrictions();
        if(b!=null){
            if(b.containsKey("SOME_KEY")) {
                return b.getString("SOME_KEY");
            }else{
                System.out.println("bundle is not null");
                for (String s: b.keySet()){
                    System.out.println("key in b is : " + s);
                }
                System.out.println(b.isEmpty() + " bundle is empty");
            }
        }else{
            System.out.println("Bundle is null");
        }
        return "";
    }

I've always got the output:

bundle is not null
true bundle is empty

although I've set the default value for the restriction. Why am I not getting at least default value for the restriction? Why am I never get an actual values (at the server side I've set the values with MobileIron Cloud and its AppConnect configuration)? Tried with several devices. What am I missing? Please help. My goal is to remotely set-up some key-value to the app.

Answer 1

If you're not receiving any restrictions at all then it's probably because your app isn't part of a managed profile. App restrictions only work in two scenarios... your device has been provisioned using your EMM console (can only be done after a factory reset) or your device has an Android for Work profile that is managed by your EMM console. You don't actually need to declare each restriction in the manifest, that only allows the EMM to provide that information in their console.

The easiest way to test your app restrictions on an unprovisioned device is to download the Test DPC app from the google play store. Setting it up will encrypt your device and install a work profile you can use for testing. You can use the DPC app to simulate applying app restrictions, reading the restrictions from manifest, and a number of other things EMMs do. You can install your app on the work profile using adb or by following the developer's guide to tell Android Studio how run the app in your work profile.

https://developer.android.com/work/guide.html#testing

Answer 2

These two posts should help post1 and post2.

Fred helped me understand from those posts, but to summarize:

If an item has not been explicitly set by a managed configurations provider, then that item will not be in the Bundle. An empty, but "not null" bundle just means nothing has been set by a managed configurations provider. The defaultValue in the managed configurations XML file is not used here. And the app is not being actively managed.

To get the defaultValue, query the configuration item's value using this RestrictionsManager.getManifestRestrictions(). It returns a list of all the RestrictionEntry objects as they are set in the managed configuration XML file. This means the value of the item is the defaultValue as defined in the XML file.

Answer 3

I had the same problem. We have tested with an Xamarin csharp app, used the public google test app "Test DPC" available via Play Store. It has a button "Load manifest restrictions" that should be able to load the app restrictions defined (it did not, in my case anyway). It worked only, if:

1. I did NOT debugged the application (there the values applied with DPC always not defined/empty) but started at the device directly, and
2. add/set the key/value pairs manually within the Test DPC app.

Then I got my boolean values switched from within DPC... (ensure you pressed "Save" within "Manage applications" screen)