Configuration Tool

Security Tab

General Options

• Enable Device Administrator - Enables KioWare Lite for Android to run as an Android device administrator so that it will run on top of the Android lock screen.  This is the most secure way to run KioWare Lite for Android and is highly recommended.  [This setting is included in the KioWare Lite for Android security/configuration audit; see Audit Tab, Security, Enable Device Administrator and Audit Tab, Security, Exit Passcode.]
  
  Note:
  
  1. If the device administrator passcode (see “Exit Passcode” below) is NOT set when enabling the above option, KioWare Lite for Android will prompt you to set one.  If you do not enter a passcode, then this option will automatically be disabled.
  2. If running external apps, see warning 2 on the Toolbar tab.
  3. KioWare Lite for Android can automatically enable or disable Administrative mode on install or upgrade by including this setting in a special provisioning XML file (see Installation and Requirements, Installation Instructions, Provisioning).
  
  
• Exit Passcode - Doubles as a way to configure the KioWare Lite for Android exit passcode and the device administrator exit passcode.  [This setting is included in the KioWare Lite for Android security/configuration audit; see Audit Tab, Security, Exit Passcode.]
  
  
• Note: Your device administrator passcode MUST be set if you expect to run KioWare Lite for Android as a device administrator.
  
  
• Enable Quick Exit - WARNING: Use this ONLY while you are testing because it enables exiting without a passcode.
• Hide System Dialogs - If checked, all dialogs (popup windows) generated from the tablet will be hidden.
  
  
• Note: With Samsung tablets, virtual keyboards are considered to be system dialogs and will be hidden if this option is checked.
  
  
• Disable Status Bar - (Available only with Android 4.4 and higher) If checked, swiping down on the tablet's status bar when running KioWare Lite for Android will not allow items on the bar to be opened.  [This setting is included in the KioWare Lite for Android security/configuration audit; see Audit Tab, Security, Disable Status Bar.]
• Selected Home App - Allows choosing a different Android home app if another is available.  If KioWare Lite for Android is not your home app currently, you probably need to go into the Android settings at “Applications”, “Manage applications” to clear the defaults of the current selected home app.  If you are able to click the Android “Home” button to leave KioWare Lite for Android, something else is your home app, and should be switched to KioWare Lite for Android instead.  For security reasons, KioWare Lite for Android is not able to do this for you.  [This setting is included in the KioWare Lite for Android security/configuration audit; see Audit Tab, Security, Selected Home App.]
  
  
• Note:
  
  1. The most secure way to run KioWare Lite for Android is to make it a device administrator that runs at boot.  If KioWare Lite for Android is a device administrator, the home app is not an issue.
  2. If “Enable Device Administrator” (see above) is disabled and “Start on Boot” (see General Tab, Start on Boot) is enabled, the launcher requires a passcode (if set) to exit the browser when tapping the four corners of the screen.
  
  
• Protocol Access List - Specifies the list of protocols (default is _mailto) for which KioWare Lite for Android will attempt to launch a third-party application to handle (i.e., the default handler at the operating system level).  General guidelines for entering protocols are as follows:
  • Enter protocols as a comma-separated list with no spaces (they will not be trimmed).
  • Colons (:) are optional, and case does not matter.
  • An asterisk (*) entry will match everything (must be by itself with no colon).
  • A minus sign (-) can precede any entry to indicate that it should be blocked instead of allowed.  These entries will display the URL blocked page.
  • An underscore (_) can precede any entry to indicate that it should be blocked silently (will do nothing and not display the URL blocked page).
  • The minus sign (-) and underscore (_) can be used with the asterisk (*) to block everything.
  • All entries are processed in the order listed with a first match policy (see example below).
    
    
  • Example:
    To block mailto silently, allow rdp, and block everything else with an error message, enter the following:
    • _mailto,rdp,-*
    
    
• Browsing Access List - Select this option to configure which pages and resources can be accessed by KioWare (see Browsing Access List below).  [This setting is included in the KioWare Lite for Android security/configuration audit; see Audit Tab, Security, Browsing Access List.]
• Application Manager - Select this option to configure which Android applications and groups of applications (activities) are allowed to run in KioWare Lite for Android (see Application Manager below).
• Download Manager - Select this option to configure settings for downloading files (see Download Manager below).
• Basic Authentication List - Select this option to configure KioWare Lite for Android to fulfill basic authentication requests from websites (see Basic Authentication List below).

Rooted Device Options

• Hide System Bar - (Requires root privileges to enable/disable) Attempts to hide the system bar when KioWare Lite for Android runs.  This action requires root access which means that it is usually only possible if your tablet has been "rooted".
  
  
• NOTE: This setting ONLY works on devices PRIOR TO Android 5.0.
  WARNING: You will not be able to exit full screen videos without the “Back” button on the system bar.  You will also not be able to switch from or exit other apps.
  
  
• Exit Shutdown Option - (Requires root privileges to enable/disable) When enabled and either the “Enable Device Administrator” or “Enable Quick Exit” option is checked (see above for these options), a “Shutdown” button displays when exiting KioWare Lite for Android.  This button allows users to exit and shut down the device at the same time.  [This setting is included in the KioWare Lite for Android security/configuration audit; see Audit Tab, Security, Start on Boot/Shutdown Option.]

Browsing Access List

Used to restrict which domains and/or pages can be accessed when running KioWare Lite for Android.  Most times you will want to check the “Set Allow List” checkbox to make the access list an allow domain list instead of a revoke domain list.  If the list is empty, nothing is blocked.  [This setting is included in the KioWare Lite for Android security/configuration audit; see Audit Tab, Security, Browsing Access List.]

Note: Pages and resources (css, js, ...) are considered, but resources are not queried all the time so they are easy to miss when testing.  This is a limitation of the browser control, not KioWare Lite for Android.

• Set Allow List (Domain) - If checked, domains entered below will be included on an allow list.
• Match On - Specifies what KioWare Lite for Android will check when deciding to allow or block a page.  When selected, a popup window will display the following options:
  • Page URLs and Resource URLs - Prompts KioWare Lite for Android to check if both the page URL and all resources are allowed.
  • Page URLs Only - KioWare Lite for Android will only check page URLs and will ignore resource URLs.

See also the browser JavaScript functions in the Scripting section of this user guide:

• KioWareUtils, Browser Functions, isUrlBlocked
• KioWareUtils, Browser Functions, getLastBlockedUrl
• KioWareUtils, Browser Functions, NavBlocked Page

Domain Entries

• Add New Domain - Select this option (see image above) to add a new domain.  A popup window displays the following settings:
  • New Domain Entry - Enter a domain to use for filtering web pages.
  • Entry is Regular Expression - Check this box if the domain is a regular expression (CONTAINS match).
  • Entry is Allow List - Check this box if the domain is to be included in an allow list.
    
    
  • Note: If you check “Entry is Allow List” and then add a domain, pages for that domain are still blocked.  To unblock a domain's pages, edit the domain and check “Set Allow List” (see below).
    
    
• Edit Domain - Click the pencil icon (see image above) to edit a domain.  The settings below will display.
  
  

  

  • Domain Entry - The domain to use for filtering web pages.
  • Entry is Regex - Check this box if the domain is a regular expression (CONTAINS match).
  • Set Allow List (Page) - Check this box if pages for the domain are to be included in an allow list.
  
  
  
• Page Entries
  
  
  • Add New Page - Select this option (see image above) to add a new page.  A popup window displays the following settings:
    • New Page Entry - Enter a page to use for filtering.
    • Entry is Regular Expression - Check this box if the page is a regular expression (CONTAINS match).
  • Edit Page - Click the pencil icon (see image above) to edit a page. “Page Entry” and “Entry is Regex” can be edited (see image below).
    
    

  

Guidelines for Editing Domains and Pages

• General Rule of Thumb - There are two ways that KioWare Lite for Android matches entries.  The default is by simple CONTAINS matches.  Another is by regex matching.
  • Matches are CONTAINS matches (unless it's a regex).
  • The longer the entry in a domain or page rule, the more strict a match.
  • With two domains that are the same except that one is longer than the other, always place the longer one first because when KioWare Lite for Android finds a matching domain in the list, it does not continue to look for more (e.g., do not put “foo.com” above “svr2.foo.com”; see table below).

  • EXAMPLE DOMAIN ORDER
    foo.com svr2.foo.com	Non-recommended order	Will always match on foo.com
    svr2.foo.com foo.com	Recommended order	Will match on svr2.foo.com and foo.com

• Domain Rules - The domain you enter should not have the protocol (such as “http://”) preceding the name, and you can enter any portion of the domain name depending on how restrictive you wish to be.

  • EXAMPLE DOMAIN MATCHES
    Domain	Will Match	Will Not Match
    foo	www.foo.com www2.foo.com www.foo.net www.foodeat.com (i.e., any domain with “foo” in it)	Any domain without “foo” in it
    foo.com	www.foo.com www2.foo.com www.twofoo.com	www2.foo.net
    .foo.com	www.foo.com www2.foo.com	foo.com www.twofoo.com www2.foo.net
    www.foo.com	www.foo.com	www2.foo.com www.foo.net
    .com	www2.foo.com www.foo.com www.twofoo.com (i.e., any domain with “.com” in it)	Any domain without “.com” in it

• Page Rules - The path/filename you enter should not have any domain information (ex, “http://www.foo.com”), and you can enter any portion of the path/filename depending on how restrictive you wish to be.

  • EXAMPLE PATH AND FILENAME MATCHES
    Path/Filename	Will Match	Will Not Match
    foo	main/foo.html product/foo.html main/foo.asp foo/default.asp (i.e., any page with “foo” in its path)	Any page without “foo” in its path
    foo.html	main/foo.html product/foo.html	foo.aspx
    ads/foo.html	english/ads/foo.html spanish/ads/foo.html	ads/main/foo.html
    /ads/	Any page with “/ads/” in its path (e.g., “english/ads/active/foo.html”)	Any page without “/ads/” in its path

  Note: Pages that are part of a Revoke List will have a red “X” through their page icons.
  
• Regex Matching - Any domain or page can be matched using regular expressions rather than simple CONTAINS matching.  The most common use of regex will most likely be "begins with" and "ends with".

  • EXAMPLE REGEX MATCHES
    Regex	Will Match	Will Not Match
    ^www.kioware.com$	Only www.kioware.com	Anything other than www.kioware.com
    ^/foo.html	/foo.html	/bar/foo.html

• File System Matches - To match a file or directory on the file system, use an empty string regex domain match.  The syntax is: $^ and means that the string begins and ends with nothing.  The page under the domain can then be used for the path.  Note that you must use a regex that means empty string becuase the Config Tool will not allow you to use empty literals.

Application Manager

• Inactivity/Activity Service - [Also appears on the Single Application Mode screen (see below) and on the Attract/Inactivity Tab] Selecting this option provides access to the “KioWare Kiosk” option in the tablet's accessibility settings.  When this option is turned on, activity in third-party applications (accessed via custom toolbar links; see Toolbar Tab, Custom Toolbar Links) registers as user activity in KioWare Lite for Android.
  • If enabled and the “Default Inactivity Timer” (see above) times out, KioWare Lite for Android will be brought to the front, running over top of the third-party application.
  • If disabled, the third-party application will continue running on top, but the KioWare Lite for Android session will end.
  [This setting is included in the KioWare Lite for Android security/configuration audit; see Audit Tab, Attract/Inactivity, Accessibility Service.]
  
  
• Note: KioWare Lite for Android can automatically enable or disable the Accessibility Service on install or upgrade by including this setting in a special provisioning XML file (see Installation and Requirements, Installation Instructions, Provisioning).
  
  
• Single Application Mode - Configures settings for running only one application (that is not KioWare Lite for Android) on the tablet (see Single Application Mode below).
• Match On - (Unavailable with Android 5.0 and higher) Android uses what is called an activity stack (for more information, refer to Android Developer Guide, Tasks and Back Stack).  KioWare Lite for Android utilizes these stacks to decide whether or not to allow/block the current application.  The “Match On” setting determines what part of the current stack to check.
  • Bottom Only - (Default for backward compatibility) Matches only on the bottom activity.  When the bottom activity of the stack is an allowed activity (see Allowed Applications below), then the currently visible application is allowed.
  • Top Only - (Recommended) Matches only on the top activity.  If the top activity (currently visible) of the stack is not allowed, then KioWare Lite for Android will start the last allowed activity.
  • Bottom and Top - Matches on both the top and bottom activities.  Both the bottom and top activities of the stack must be allowed (see Allowed Applications below) for the currently visible activity to be allowed.
    
    
  • Note:
    1. We recommend using “Top Only” because if your application attempts to open an application that is not allowed, then this new application will be blocked.
    2. Create a blockdebug.txt file (can be blank) and place it in KioWare Lite for Android's data directory (usually /sdcard/Android/data/com.adsi.kioware.client.mobile.app) to display the activity class paths whenever an activity is blocked.

Application List Tools

The following settings apply to the allow list (see Allowed Applications below).

• Sort Application List - Sorts the allow list alphabetically (applications are not listed alphabetically for selection and may not be added in alphabetical order).
• Add All Applications to List - Adds all available Android applications to the allow list.
• Remove All Applications from List - Clears the allow list.

Allowed Applications

• Add New Application - Displays a listing of all available Android applications.  Select any application to add it to the allow list.
• Edit Application (pencil icon) - Displays a listing of all activities that contain the application.
  • Click the pencil icon to edit the activity class name.
  • Click the “Minus” (-) button to remove the activity from the allow list.

Single Application Mode

• Enable Single Application Mode - If enabled, only one application (and not KioWare Lite for Android) will run on the tablet.
• Application - Displays a listing of all available Android applications.  Select the one to run on the tablet.

Inactivity Timers

• Enable Inactivity Timer - If checked, KioWare Lite for Android will display attract screens when the inactivity timer starts (see Attract/Inactivity Tab, Inactivity Timers).  If no attract screens are set up, then your “Start Page URL” will display (see General Tab, Start Page URL).
  
  
• Inactivity/Activity Service - [Also appears on the Application Manager screen (see above) and on the Attract/Inactivity Tab] Selecting this option provides access to the “KioWare Kiosk” option in the tablet's accessibility settings.  When this option is turned on, activity in third-party applications (accessed via custom toolbar links; see Toolbar Tab, Custom Toolbar Links) registers as user activity in KioWare Lite for Android.
  • If enabled and the “Default Inactivity Timer” (see above) times out, KioWare Lite for Android will be brought to the front, running over top of the third-party application.
  • If disabled, the third-party application will continue running on top, but the KioWare Lite for Android session will end.
  [This setting is included in the KioWare Lite for Android security/configuration audit; see Audit Tab, Attract/Inactivity, Accessibility Service.]
  
  
• Note: KioWare Lite for Android can automatically enable or disable the Accessibility Service on install or upgrade by including this setting in a special provisioning XML file (see Installation and Requirements, Installation Instructions, Provisioning).
  
  
• Kill App at Session End - If checked, the application that runs on top of KioWare Lite for Android will be closed when the session ends (when Attract screen mode starts; see Attract/Inactivity Tab, Attract Screens).  Note: Advanced users can create a file called SessionEndKillPkgs.json in the UserData directory under Android/data/com.adsi.kioware.client.mobile.app and set up packages to be closed at session end, even when not using Single Application mode.  For more information on this, please contact KioWare support via phone (Toll Free USA: 877-843-4790; International: 1-717-843-4790) or our website (www.kioware.com).

Exiting KioWare

• Enable Exit Button - If enabled, an “Exit” button will display on the tablet when the selected application (see “Application” above) is running.  Tap four times on the button to exit KioWare Lite for Android.
• Button Position - Sets the position on the screen where the “Exit” button will display (e.g., top left, middle right, middle of screen).
• Exit Button Visibility - If disabled, the “Exit” button will be invisible but still clickable when the selected application (see “Application” above) is running.
  
  
• Note:
  
  1. If enabled but not made visible, the “Exit” button will be visible for 20 seconds at boot/start of Single Application mode (including relaunch of KioWare Lite for Android).
  2. Using the “Exit” button, similar to the KioWare Lite for Android exit, requires a passcode.

Download Manager

Note: Downloads can also be managed by an addin.  For more information on addins, please contact KioWare Support via phone (Toll Free USA: 877-843-4790; International: 1-717-843-4790) or our website (www.kioware.com).

• Download Directory - Path to the directory where downloads will be stored.  The default path of storage/emulated/0/Download should be used.
• Session End Behavior - Specify how KioWare Lite for Android will behave if the session is about to end when a file is being downloaded.
  • Prompt user before timeout - A warning will alert the user that the session is about to end.
  • Pause timeout during download - The timeout will pause and resume when the download is complete.
  • No behavior change - If timeout ends, the download stops and the session ends.
• Warn Before Timeout - When the time remaining in a user session (in seconds) equals this value and a file is being downloaded, a session end warning will display.
• Allow Downloads on Mobile Networks - If enabled, files can be downloaded on 4G networks.  If disabled, files will be queued until the device reconnects to Wi-Fi.  Note: In the latter case, we recommend using the progress dialog (see Downloads by Mime Type, Edit Download, Show Progress Dialog below).  This will indicate to the user if something should be downloading but is not.
• Display PDFs in Browser - If enabled, the KioWare Lite for Android browser can download and display PDFs.  If disabled when trying to display a PDF, the browser will indicate that the download has been blocked.

Tools

• Select a Common Mime Type - Displays a list of common mime types.  When a file starts downloading, KioWare Lite for Android will check this list for a matching mime type.
• Get Mime Type from URL - For a mime type that is not in the list (see “Select a Common Mime Type” above), enter the URL needed to retrieve the mime type.

Note: Additionally, there is a PDF viewer application that can be run in conjunction with Device Administrator mode (see General Options, Enable Device Administrator above).  Please contact KioWare Support for more information.

Downloads by Mime Type

• Add New Download - Select this option to add a new file download.  A popup window displays the download settings (see “Edit Download” below for descriptions of these settings).
• Edit Download (pencil icon) - Select the pencil icon (see image above) to edit file download settings (see image below):
  • General Options
    • Mime Type - Enter the mime type (string that tells KioWare Lite for Android the file extension).
    • Action on Download Complete - Specify how KioWare Lite for Android will behave when the file download is complete.
      • Automatically Open - The file automatically opens.
      • Prompt User - A popup window indicates that the download is complete.
      • Do Nothing - The download stops and the session continues normally.
    • Show Progress Dialog - If enabled, a progress bar will display during the download.
    • Clear on Session End - If enabled, all downloaded files will be removed when the session ends.  KioWare Lite for Android will keep a record of all the files.
  • Tools
    • Associate Mime Type to Application - Displays available applications that can be associated with the mime type.  Downloaded files with the matching mime type will always open in the selected application.
  
  

• 

Basic Authentication List

• Enable Basic Authentication - If enabled, KioWare Lite for Android will automatically sign into basic authenticated websites based on the settings for “Host”, “Realm”, “Username”, and “Password”.
• Add New Entry - Select this option to add a new basic authentication entry.  A popup window displays the related settings (see “Edit Entry” below for descriptions of these settings).
• Edit Entry (pencil icon) - Select the pencil icon (see image above) to edit basic authentication settings (see image below):
  • Host - The name of the web host.
  • Realm - The realm set up on the server (collection of web pages/resources and users, all controlled by the same authentication policy).
  • Username - The username to log onto the basic authenticated website.
  • Password - The password to log onto the basic authenticated website.
  • Use for Downloads - If checked, any download that occurs from the “Host” (see above; “Realm” is ignored) will require use of the “Username” and “Password” entered above.  If a single host has this checkbox checked for more than one basic authentication rule, then the first match in the basic authentication list will be used.
  
  

•