How To Fix An Incompatible Save File Ksp

Knox Service Plugin

If you are non already familiar with the Knox Service Plugin (KSP), browse the KSP Admin Guide and Release Notes.

Minimally, to support managed configurations, you can use an iframe to display configurable settings, as described in Deploy managed configurations. To support the KSP implementation of OEMConfig, y'all must support the post-obit:

advanced app restrictions-including multi-level nested schema to return managed configuration of KSP. Notation the special considerations in Schema section that follows, and ensure support for these features.
feedback aqueduct-based on an SDK provided by Google, to fetch results back from the KSP Amanuensis and brandish them on your web panel.

Schema

Because the all-encompassing Samsung Knox characteristic set, readability and usability is a major business. To accost potential usability concerns, KSP uses a schema with up to four nesting levels with a combination of:

<bundle>
<bundle_array>
one of the basic types: boolean, string, integer, choice and multi-select

In particular, you should note that the OEMConfig (avant-garde app restrictions) schema relaxes the constraints that a normal application restrictions schema places on applications that have managed configurations. For example, a parcel tin be outside of a bundle_array and more than two levels of nesting is immune.

The image beneath shows the high level categories of policies and common configurations. It has four main components.

Basic elements-General operational controls for KSP. For instance, plow on debug mode or input a KPE license cardinal.
Device-wide policies section-Device Owner (Practise) policy controls. These are of global scope.
Work profile policies section-Contour Possessor (PO) policy controls. These apply to just the Knox Workspace.
Configurations-Specific configuration backdrop that are used in conjunction with policy controls. For instance, VPN contour settings, APN settings, or DeX customization settings. These can exist used on either device-wide policies or work contour policies.

You can prepare up a uncomplicated iframe to evidence the KSP schema file. For details, see the General Steps. Here is an example of how the KSP schema looks:

Note a few salient points on the schema and elements used by KSP:

Uses 4 levels of nesting in its schema, which the MDM panel should be able to parse and handle while rendering the UI.
Uses an element of subconscious restriction blazon (for example, android:restrictionType="subconscious") that the MDM console should not display to the user, but must pass to the device along with the rest of managed configuration data to KSP. An example of this type of data is schema version, which helps KSP recognize and parse the incoming data elements accordingly.
Uses the following types of bundles:
- Bundle within bundle-Biometric authentication inside Password policy
- Package-assortment inside bundle-Application shortcuts within DeX Configuration
- Bundle inside a Bundle-assortment-Single VPN contour within VPN Profiles array
Specifies default values for elements of type Boolean, String, Integer, Choice and Multi-select. The MDM panel should accolade these values when loading the schema from Play shop to render UI for customers.

Use models

The KSP Agent supports Android Enterprise deployments based on Practice, PO, and COMP modes. However, KSP does not back up legacy deployments such Knox Workspace Corporate Liable (CL) and Container Simply Mode (COM).

Deployment Mode	Supported OS version
Exercise mode	Android O and in a higher place, with Knox 3.x
PO and COMP mode	Android P and higher up, with Knox 3.2.1

Use cases to test

We suggest testing your system with following KSP use-cases:

Utilise the console to notice the KSP Amanuensis in the Google Play store, fix, and save Knox policies using the agent.
Publish the policy to one or more devices. Install the KSP on target device and upon launch information technology volition execute the Knox policies.
Use the console to modify an existing policy and push button an updated policy to an already provisioned device.
Check performance on a device with Android P and optionally on a device with Android O.
Check performance by deployment manner: DO and PO.
If the MDM supports a feedback channel, and then likewise test that results from KSP are received and displayed on the console.

Additional recommendations

There are a few additional recommendations to consider when supporting KSP, including:

Support OEMConfig apps differently on the MDM panel, as compared to normal applications that support managed configurations. This is considering some steps and options typically supported for normal apps such as enforce VPN may non apply for OEMConfig app.
We strongly recommend enabling the car update setting for the OEMConfig apps. This reduces issues when an It Admin uses a newer version of KSP to set a policy on the console, while some of the managed devices employ an older version of KSP, and consequently cannot use the policies.
Restrict users from deleting individual policies or policy groups on the console, every bit this might cause issues in subsequent policy updates if a user wants to add together back a deleted policy.
Include all the elements in the managed configuration data pushed to KSP, even if IT admin did not modify some policies while editing the configurations. KSP can and so correctly identify delta and interdependencies.
Recall to not show subconscious restriction types to users. Hidden restrictions are reserved for the MDM backend and/or KSP simply.
An MDM Agent that supports KPE Premium License activation should continue to do it.

Permissions

As described in Declare Knox permissions, do not declare the selective permissions meta tag in the Android manifest file. By leaving out this tag, your app will go all Knox permissions, which are needed by KSP by default.

License handling

KSP supports license activation simply there are nuances in the behavior. KSP cannot deactivate license since Practise or work profile un-enrollment well-nigh oft involves wiping device data including the KSP application. In such cases, the license seat is usually released past Knox license service with Automatic Seat Release mechanism later on a sixty-24-hour interval inactivity menses.

To enable seamless experience for It Admins and to ensure that Android O devices can also do good from KSP:

We recommend that you continue to support the KPE Premium License on the console along with activation and deactivation in their device amanuensis, as they accept in the past.
As recommended by Google, MDMs phone call wipeData following DO and PO un-enrollment.

KSP app for reference

As part of OEMConfig development, you tin can refer the KSP app published at https://play.google.com/shop/apps/details?id=com.samsung.android.knox.kpu. This tin help test console UI and deliver managed configurations to the KSP app using the Managed Google Play shop.

To try out the KSP app, follow these steps. For detailed steps on how to ready policy and test, refer to the KSP Basic Examples.

On the console:
- Use managed Play store to search for Knox Service Plugin and add information technology to the list of approved apps
- Set up a Knox policy as managed configuration. The exact steps depend on the MDM panel. To run across how to set upward KSP in different MDM consoles, meet the KSP Admin Guide.
- Save the configuration and publish to ane or more test devices, running Android O or P and Practise deployment.
On the exam device running Android P (with Knox 3.2.1 or above):
- Follow the normal device provisioning steps required for the MDM.
- Verify that the KSP app is installed by the Google Play shop client.
- If verbose fashion is enabled, then check that KSP agent shows a log printed on UI to confirm that managed configuration is received correctly.
- If verbose mode is off, so check that KSP shows a notification indicating that Knox policies are candy successfully.
If the test device is running Android O (with Knox 3.ten):
- Follow the normal device provisioning steps required for the MDM.
- Verify that the KSP app is installed past the Google Play shop client.
- Manually launch the app.
- Click on Apply latest policies.
- Check the log on the UI to confirm that managed configuration is received correctly.