SOTI Surf | Configuration Details (iOS/ iPadOS)

Use the SOTI Surf profile configuration to configure settings for your SOTI Surf app when:

This app closes based on the delay configured in the Delay Application Update settings and restarts once you update and assign the SOTI Surf profile configuration.

Branding

Select Configure to open the Brand Settings panel, where you can define SOTI Surf branding options.


Enable Customized Branding	Turn this toggle on to display the branding options.
Primary Color	Select the primary background color for the SOTI Surf page, which appears when the app is loading.
Text Color	Select the text color for the SOTI Surf page, which appears when the app is loading.
Upload Logo	Browse for an image to serve as the app logo. You can also drag the image file and drop it into the field.
Use White Background	Turn this toggle on to display a white background on the splash screen.
Preview	This section enables you to preview the branding options you define. You can switch from a phone to a tablet image by selecting the corresponding icon on the section toolbar.

Home Screen

Add home screen catalog entries, a home screen website, or corporate bookmarks for the SOTI Surf app.

With website filtering enabled on the profile configuration, websites configured as the home screen or as part of the home screen catalog are automatically added to the allow list.

Note: When a device receives many profiles that include SOTI Surf, SOTI Surf resolves any conflicts as follows:

If a device has more than one home screen website enabled, the profile assigned first supersedes all others.
If a device has more than one home screen catalog enabled, SOTI Surf adds all websites from all profiles to the catalog on the device.
If a device has a website and a catalog enabled, the home screen website supersedes the catalog.
If a device has a profile with the home screen enabled and another disabled, the profile with the enabled home screen supersedes the disabled setting.
Corporate bookmarks from many profiles form into a unified set.

Activate the Enable Home Screen option to manage how SOTI Surf's home screen displays to device users. Then, select one of the following options:

Catalog: Provides a set of websites as links on the SOTI Surf home page. You can group links into folders.
Website: The home screen of the app is a chosen website.

Table 1. Catalog
Websites	Add websites to appear as links on the SOTI Surf home page. Select New in the Websites table to add a new catalog entry. To delete a website, hover over its row and select Delete Use the arrows to arrange the order in which websites appear on the SOTI Surf home screen.
Add Folders	Group websites into different folders. If you have many websites, you can simplify the app home screen by organizing website links into folders. Select the new icon in the Add Folders table to create a new folder. On the Add Folders screen, enter a name for the folder and select the (new) icon to add websites to the folder. Select OK once you have finished adding websites. You can add many folders and then arrange their order of appearance on the device screen.
Show Websites Before Folders in Catalog	Show website links before folders on the app's home screen.

Table 2. Website
Home Screen URL	Enter the website URL to use as the SOTI Surf home page.
Configure Corporate Bookmarks	Add websites as bookmarks to SOTI Surf. Select (new) in the Configured Corporate Bookmarks table to create a new row. Enter a display name and the website's URL. Listed websites appear as corporate bookmarks. To delete a bookmark, hover over its row and select Delete Use the arrows to arrange the order in which websites appear on the SOTI Surf bookmarks menu.

Settings

Important: If you want to prevent device users from reversing a setting in the SOTI Surf app, enable the User Configurable toggle for the applicable setting.


Auto Hide Top and Bottom Bar	When enabled, device users can not see or access the top and bottom bars of SOTI Surf.
Full Screen Mode	When enabled, SOTI Surf remains in full-screen mode.


Restore Tabs on Startup	When enabled, tabs from an earlier session are automatically loaded the next time you launch the SOTI Surf app.
Open Links in New Tab	When enabled, links open in a new tab instead of the current tab.
URL Suggestion	When enabled, SOTI Surf suggests websites as the device user types in the address bar.


Hide Reset Settings	When enabled, device users can not see or access the Reset Settings option in the SOTI Surf app.
Open Same Link in Same Tab	Enable the device user to open the same link in the same tab if the link is already open.
Set User Personal digital assistant	Select the User Personal digital assistant used by SOTI Surf to access web applications. Use this feature when devices can not accurately render certain web page applications by SOTI Surf. You can choose from: Default: SOTI Surf's built-in User Personal digital assistant. Desktop: The desktop version of SOTI Surf's User Personal digital assistant. Restriction: From the SOTI Surf app on a device, disabling the desktop site while viewing websites is impossible. Chrome: SOTI Surf renders web pages identically to how Google Chrome would render them. Restriction: From the SOTI Surf app on your device, disabling the desktop site while viewing websites is impossible. Custom: Input a User Personal digital assistant string to adjust how SOTI Surf renders a webpage. See What is my User Personal digital assistant to view the User Personal digital assistant string for the current browser.

Table 3. Authentication
Enable Certificate Authentication	Option to map the certificate to a domain for automatic authentication in the SOTI Surf application.


Browsing on Cellular	When enabled, the SOTI Surf app can use cellular networks.
Wi-Fi	When enabled, the SOTI Surf app can use Wi-Fi networks.

Use Log In

When enabled, select from Lightweight Directory Access Protocol (LDAP) or IDP.

LDAP: Device users must use their LDAP credentials to log into SOTI Surf. Configure intranet gateway settings to use this option.
IDP: Add () a user group. You can use Manage Services to set up a connection to SOTI Identity and use its Single Sign On (SSO) authentication. After you have successfully connected to a SOTI Identity tenant, user groups are now available to search. Other IDPs may be used, as this feature is available for SOTI Identity only.

Specify the user's inactivity time (in minutes) before the user gets logged out. Enter zero to enable inactivity timeout for the browser.

After the profile is successfully assigned to a device, the following scenarios could happen:

LDAP: If a device gets assigned many SOTI Surf configurations with conflicting Enable LDAP Login settings, the configuration with LDAP enabled applies. If many configurations have LDAP enabled but with differing inactivity timeouts, the timeout period specified in the configuration applied first supersedes the later configurations.

IDP: After a device signs in once, SOTI Surf receives access to all available web applications from SOTI Identity.


Access Token Validity Period	Specify the access token validity period. Note: The default value is 5 minutes. You can set the validity period in minutes, hours, or days. The allowed ranges are: Minutes: 5 to 59 Hours: 1 to 23 Days: 1 to 365 Leaving these fields blank triggers the required field validation.
Refresh Token Validity Period	Specify the refresh token validity period. Note: The default value is 28 days. Set the validity period in days. The allowed range is: Days: 1 to 365

Note: If the access token value is equal to or greater than the refresh token value, a validation message appears:

Access token value should be less than refresh
										token value

. Similarly, if the refresh token value is less than the access token value, a validation message appears:

Refresh token value should be higher than the
										access token value

Note: If the access and refresh token values are the same, the following error appears on the refresh token field:

Refresh token value should be higher than the
										access token value

Delay Application Update

Set the duration (in minutes) between the moment a configuration change is sent to the device and when the app must close to apply the update. During this process, device users must log in again. After the update has completed, the device automatically restarts the app.

If a device gets assigned many SOTI Surf configurations with conflicting app shutdown times, the first configuration created applies.

Open New Tab in Background

When enabled, selecting a link opens a new tab in the background.

Note: If a device has many assigned profiles but has conflicting tab opening settings, the setting of the profile created first applies.

Allow Zoom Gestures When enabled, device users can use gestures to zoom in and out in web pages.

Allow Media Auto-play Enabling this feature lets video and audio clips start playing automatically. Muted videos still play automatically.

Hide Discuss Bar When enabled, the discuss bar in the SOTI Surf browser becomes hidden. This prevents device users from entering or modifying website URLs, limiting access to the websites listed in the Home screen catalog.

Allow Pull to Refresh Enabling this option lets the user refresh the web page using the pull-down gesture.

Auto-Refresh Enabling this option refreshes the web page automatically according to the defined frequency.

Refresh Interval Define the auto refresh interval for web pages.

Search Engine

Select a default search engine for SOTI Surf to run searches from the discuss bar.

If a device assigned to more than one profile has conflicting settings, the search engine from the first assigned profile applies.

Surf Debug logs Enable this option to add the Send Debug Report option in SOTI Surf that sends debug logs to SOTI over File Transfer Protocol (FTP).

Privacy

The privacy settings section in the SOTI Surf profile configuration enables the browser to dictate the browsing capabilities of device users.

If more than one profile with different SOTI Surf configurations applies to the same device, the most restrictive version of the setting is used. In general, settings enabled in the Privacy section are more restrictive, with some noted exceptions.


Allow Copy from Browser	When enabled, device users can copy content from within a browser, both to other web pages, and to apps outside of the browser. Note: Enabling this option also enables Allow Screen Capture when Browsing and Allow Sharing of Downloaded Files. Both options can be enabled without disabling Allow Copy from Browser.
Allow Downloading of Files	When enabled, device users can download files from within the SOTI Surf app. Note: Enabling this option also enables the Allow Sharing of Downloaded Files setting. However, this option may be deselected independently of Allow Downloading of Files.
Allow Sharing of Downloaded Files	When enabled, device users can share any files they downloaded in SOTI Surf with another person or app.
Restrict File Types	Specify file extensions for file types to block device users from downloading. Separate each file extension with a comma. For example: `.pdf`, `.docx`, `*.txt`.
Allow Printing	When enabled, device users can print any content from within the browser. Note: Allow Printing does not allow cloud printing on sites such as Gmail, where printing options are available.
Allow JavaScript	When enabled, JavaScript runs on web pages. Note: Device users may experience significant limitations when navigating the internet due to the prevalence of JavaScript.
Allow Popups	When enabled, SOTI Surf prevents websites from opening pop-up windows. Websites can display the use of alerts or confirmation boxes, but cannot open new web pages.
Allow Cookies	When enabled, websites can store cookies in SOTI Surf.
Clear Cookies on Launch	When enabled, SOTI Surf clears cookies from the previous session when the browser relaunches. Note: You can enable Clear Cookies on Launch independently of Allow Cookies.
Allow Website Cache	When enabled, the browser caches website data when the app closes or when the user navigates away from a web page.
Allow Safe Search	When enabled, the Safe Search filter blocks inappropriate or explicit images and videos in search results. Device users can still access other web content unless restricted by more web filtering settings. Allow Safe Search applies only to search results.
Allow Access to Websites with Invalid SSL Certificate	When enabled, device users can access websites with SSL security certificate errors.
Allow Invalid SSL Certificate Warnings	When enabled, warnings about invalid SSL certificates appear to device users. Warning: This may lead to data security issues. This option is unavailable if Allow Access to Websites with Invalid SSL Certificate is disabled.
Clear History on Launch	When enabled, SOTI Surf clears browsing history from earlier sessions when launched. Note: If a device has more than one profile with conflicting Clear History on Launch settings, the profile with the setting enabled takes precedence.
Allow Bookmarks	When enabled, device users can save web pages as new bookmarks or edit existing bookmarks in the SOTI Surf app. Note: If a device has more than one profile with conflicting Allow Bookmarks settings, the profile with the setting disabled takes precedence.
Open Files in third-party Applications	When enabled, device users can open SOTI Surf files not supported with third-party applications instead. Open Files in third-party Applications is more restrictive when disabled. Note: Devices with conflicting settings use the disabled setting and block the opening of files in third-party applications.

Filtering

Intranet Gateway Settings

Use this dialog box to set up an Enterprise Resource Gateway (ERG) for SOTI Surf. ERG routes web traffic through a proxy server and grants device users access to your internal network. ERG requires a configured proxy server to use this feature. Once ERG is active, link the server to SOTI Surf through the SOTI Surf configuration.

Refer to Installing the SOTI Apps Server Extension for more information.

Note: More than one profile can be assigned to the same device with different SOTI Surf configuration settings. If one profile has Use Intranet Gateway enabled, and another profile that targets the same device does not, then only the enabled profile applies. Also, if you assign more than one proxy server to the same device through many profiles, the device does not use all proxy servers. The device uses the first assigned proxy server's settings and ignores all other proxy servers. However, if the profiles share the same proxy settings (IP address/ Fully Qualified Domain Name (FQDN) and port number), then all the domains of each matching profile are applicable.

Turn on Enable Intranet Gateway Settings and enter your ERG proxy discuss as an IP address/FQDN and its port number in the Enterprise Resource Gateway fields.

To specify which domains you want to route through the ERG, select Add in the Add a Domain table to add a new row.

Restriction: You cannot specify domains in iOS profiles.

Tip: Select Import to upload a .csv or .txt file with a list of domains to SOTI MobiControl. To delete a domain, hover over its row and select Delete.

Enable Proxy Settings


Setting	Description
Enable Proxy Settings	Enable this option to configure how to route the intranet traffic. Once enabled, the following options display.
Select a type:	Enterprise Resource Gateway (default) or third-party Proxy.
third-party Proxy	Specify the details of the third-party proxy server you want to use (mandatory).
User Proxy Port Number	Specify the user proxy port number (mandatory).
Select type of protocol	Select the protocol for the third-party proxy to use. Choose from HTTP or SOCK5.
Is TSL enabled	Specify that the proxy server is using secure protocol.
Is authentication required	Specify that the proxy requires authentication. Enabling this causes the Username and Password to become visible and mandatory.
Username	Specify the username to authenticate the SOTI Surf user with the proxy server.
Password	Specify the password to authenticate the SOTI Surf user with the Proxy server.
Exception list	Specify the websites you want to exempt from routing through the proxy.

Note: If one profile has Enterprise Resource Gateway enabled and another has third-party Proxy enabled, the profile created first takes effect. However, if one profile enables third-party Proxy and another disables it, assigning both profiles results in the third-party Proxy being enabled.

Website Restrictions

You can block users from accessing websites based on specific URLs or by website content. You can create a blocklist, an allowlist, or block websites based on content type.

When you apply a blocklist, any site on the blocklist redirects the device user to the default URL of blocked websites or a blank page, depending on your settings.

An allowlist is more restrictive than a blocklist. The device user can only access the sites specified on the allowlist. When the device user accesses any non-allowlisted sites, SOTI Surf redirects the device user to the default URL or a blank page, depending on your settings. Redirect URLs are automatically allowlisted.

You can not apply both a blocklist and an allowlist within the same profile configuration. If a device receives a blocklist and an allowlist from two different profiles, the allowlist overrides the blocklist. If a device receives more than one blocklist or more than one allowlist from different profiles, then SOTI Surf combines all the websites (and the exceptions) from the profiles.

Turn on Enable Website Restrictions and select a type: Blocklist or Allowlist.

To specify which websites you want to filter, select Add in the Websites table to add a new row.

Tip: Select (import) to upload a .csv or .txt file with a list of websites to SOTI MobiControl.

To delete an entry, hover over its row and select (delete).

In the Redirection URL for Blocked Websites/Categories, enter a website URL. When device users try to access an unauthorized website, they are automatically redirected to the entered URL.

Turn on Exclude websites from the filter and select (add) in the Websites table to add a new website exception to your blocklist or allowlist.


Disable Message on Redirection	Select this option to disable the access-restricted toast message. Restriction: Enabling this disables the Show Pop-up while Redirection toggle.
Show Pop-up while Redirection	Display a pop-up message, prompting the user to stay on the existing page when SOTI Surf blocks a website. Restriction: Enabling this disables the Disable Message on Redirection toggle.

Website Categories to Block enables the restriction of websites by content category. Choose one or more categories from the pre-defined list, such as News. SOTI Surf blocks all sites related to each selected category.

Note: Choosing Select All blocks websites from all categories in the pre-defined list.

Add a website to the exception list of an Allowlist web filter to create an exception for web content categories.

Note: Enabling the Uncategorized setting prevents device users from accessing websites that are not categorized into any of the pre-defined categories.

Devices with blocked categories in many profiles receive all blocked categories from each applied profile.

Kiosk Mode

Kiosk mode limits SOTI Surf functionality, reducing device users' access to websites and SOTI Surf app settings. This mode disables the discussion bar, and users can only navigate forward through hyperlinks and backward using the back button. The long-press context menu is also disabled.

If you assign more than one kiosk mode setting to a device, the most restrictive one applies.

Turn on Enable Kiosk Mode to start.


Hide App Bottom Bar	When enabled, device users cannot access the bottom bar of the SOTI Surf app. The bottom bar includes the forward and backward navigation buttons, plus the home and the app menu icons. Selecting this option causes the Hide App Menu and Clear Cookies with Home options to become automatically selected.
Hide App Menu	When enabled, device users cannot access the app menu.
Clear Cookies with Home	When enabled, whenever the device user navigates to the home screen, SOTI Surf clears browser cookies. Note: This option is redundant if you select Allow Cookies in the Configure Privacy Settings section.
Allow Many Tabs	When enabled, the device user can access more than one tab in kiosk mode.
Allow Keyboard	When enabled, device users can display the keyboard. For example, when selecting a text field. Note: Device users can still use the keyboard to log in when disabled.