Re: Problem with Android Horde Activesync - Can't add account - Gmail's security settings are more secure than those set by your IT admin

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============2024361932503018367==
Content-Type: multipart/signed; micalg=pgp-sha1;
 protocol="application/pgp-signature";
 boundary="hWfP9JgmTfv91m9UfIhFDWzODz6UTLCrn"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--hWfP9JgmTfv91m9UfIhFDWzODz6UTLCrn
Content-Type: multipart/mixed; boundary="mwyZKecgHKbwFSbYGs9d98sucOxSqZ0WP";
 protected-headers="v1"
From: Ronny Forberger <[email protected]>
To: [email protected]
Message-ID: <[email protected]>
Subject: Re: [horde] Problem with Android Horde Activesync - Can't add account
 - Gmail's security settings are more secure than those set by your IT admin
References: <20191109160917.Horde.jO3f3ErAVO0zyt8tppcLP83@horde.ronnyforberger.de>
 <20191109164959.Horde.XK4oL8imzWVLIUfy-H1TZkH@tarn.theupstairsroom.com>
 <20191109172040.Horde.7gRnV6hgAq-9ELhiLwOToKn@horde.ronnyforberger.de>
 <[email protected]>
 <20191112040940.Horde.wZsYzeQ4aVdIoJ8xS3G31bH@tarn.theupstairsroom.com>
In-Reply-To: <20191112040940.Horde.wZsYzeQ4aVdIoJ8xS3G31bH@tarn.theupstairsroom.com>

--mwyZKecgHKbwFSbYGs9d98sucOxSqZ0WP
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

Hi Michael,

I tried disabling the provisioning on Horde, as described by you, but I
am still getting the same error on the Android device.

Best regards,

Ronny Forberger

Am 12.11.2019 um 05:09 schrieb Michael J Rubinsky:
>
> Quoting [email protected]:
>
>> Perhaps the problem is described here:
>> https://developers.google.com/android/work/device-admin-deprecation
>
> This may very likely be the case.
>
> I can't reproduce this on any of my devices, but I don't think the
> latest GMail app has been pushed out to any of them yet.
>
> Since this is because the device admin is being deprecated, you can
> maybe try disabling provisioning on the Horde side. You can do this
> via Admin->Permissions (Set provisioning to "disable" - be aware
> you'll lose all of the security policy settings if you do this
> though). If you want to get your hands a little dirtier, you can
> create a activesync_provisioning_check hook (see
> horde/config/hooks.php.dist). You can sniff the devices that are
> affected by maybe userAgent and return
> Horde_ActiveSync::PROVISIONING_NONE for those devices. Be aware that
> when doing either of these, you lose the ability to remote wipe a lost
> device.
>
> Without being able to reproduce this to test, I really have no idea if
> this will help, since this actually makes things less secure in a way,
> it might not,=A0 but since it removes the use of the device admin
> service, it's the best guess I have at the moment....other than using
> a different ActiveSync client like Outlook or Nine Folders.
>
>
>> I can read it, but I don't understand it. If this is the problem, the
>> solution will not come from Google.
>>
>>
>> On 9-11-2019 18:20, Ronny Forberger wrote:
>>> Hi Michael,
>>>
>>> thanks for your information.
>>>
>>> I am not sure if I have a second GMail account on the phone, I have
>>> a google account on it though.
>>>
>>> I think the Gmail application itself is now requiring certain
>>> security policies to be in place, as you said.
>>>
>>> I tried to set the permissions of ActiveSync to all permissions for
>>> authenticated users, creators and even my username, but no success.
>>>
>>> The error message on the phone is still appearing.
>>>
>>> It worked before the Android upgrade though without the Horde
>>> permissions.
>>>
>>> Any other ideas?
>>>
>>> Best regards,
>>>
>>> Ronny Forberger
>>>
>>>
>>> Quoting Michael J Rubinsky <[email protected]>:
>>>
>>>> Quoting Ronny Forberger <[email protected]>:
>>>>
>>>>> Hi Horde list,
>>>>>
>>>>> My brand new Android 9 phone has made an update to the OS and
>>>>> since that I cannot access my Horde Active Sync interface anymore.
>>>>>
>>>>> I am getting the error message
>>>>>
>>>>> Can't add account - Gmail's security settings are more secure than
>>>>> those set by your IT admin
>>>>>
>>>>> on Android.
>>>>>
>>>>> Any ideas what I have to set up on Horde / or the web server to
>>>>> make this run again or where to look at least?
>>>>
>>>> This sounds like you either maybe have another account setup in the
>>>> Gmail app on the Android device, whose provisioning policies are
>>>> more secure than Horde's, or the Gmail application itself is now
>>>> requiring certain security policies to be in place.=A0 You can try
>>>> looking at Horde -> Admin -> Permissions. Look at the permissions
>>>> available under Horde -> ActiveSync (you might need to create them)
>>>> and see if any of those look like a good candidate.
>>>>
>>>> For what it's worth, my Note has the same patchlevel, and I just
>>>> successfully added my horde account to the device, after accepting
>>>> the security policy.
>>>>
>>>>
>>>>>
>>>>> Android version: 9 PKQ1.181121.001
>>>>> Android security patchlevel: 2019-10-01
>>>>>
>>>>> Horde Version: 5.2.22
>>>>> Nginx Version: 1.16.1 (reverse proxy with mod_security)
>>>>> Apache httpd version: 2.4.41 (serving horde)
>>>>>
>>>>> Any help is appreciated.
>>>>>
>>>>> Best regards,
>>>>>
>>>>> Ronny Forberger
>>>>> -- ___________________________________
>>>>> Ronny Forberger
>>>>> ronnyforberger at ronnyforberger.de
>>>>> PGP: http://www.ronnyforberger.de/pgp/email-encryption.html
>>>>>
>>>>> -- Horde mailing list
>>>>> Frequently Asked Questions: http://horde.org/faq/
>>>>> To unsubscribe, mail: [email protected]
>>>>
>>>>
>>>>
>>>> -- mike
>>>> The Horde Project
>>>> http://www.horde.org
>>>> https://www.facebook.com/hordeproject
>>>> https://www.twitter.com/hordeproject
>>>
>>>
>> --=A0
>>
>> Cordialement,
>>
>> R.J. Baart
>>
>> --=A0
>> Horde mailing list
>> Frequently Asked Questions: http://horde.org/faq/
>> To unsubscribe, mail: [email protected]
>
>
>
>
--=20
___________________________________
Ronny Forberger=20
ronnyforberger at ronnyforberger.de
PGP: http://www.ronnyforberger.de/pgp/email-encryption.html


--mwyZKecgHKbwFSbYGs9d98sucOxSqZ0WP--

--hWfP9JgmTfv91m9UfIhFDWzODz6UTLCrn
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iEYEARECAAYFAl3LFQkACgkQC1+bGHGuHhftyQCgimKUvzbBuaA246L7jCKFoqCD
iyEAnjtXeoiWufyUFoxjoevlsKdl983x
=WVgf
-----END PGP SIGNATURE-----

--hWfP9JgmTfv91m9UfIhFDWzODz6UTLCrn--

--===============2024361932503018367==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
Horde mailing list
Frequently Asked Questions: http://horde.org/faq/
To unsubscribe, mail: [email protected]

--===============2024361932503018367==--