Managed Configuration API

1. Model

1.1. Managed devices

The API is presumed to be used on devices which are not fully controlled by the end user but rather by an external entity, the device administrator. Device administrators are given the power to fully control the managed device.

1.2. Managed configuration

For the purposes of this specification the device administrator can control a list of managed web applications. Each entry in this list can have a set JSON configuration, which is accessible by the documents hosted at the origin of the web application.

Note that this does not apply to anonymous contexts, where the observed state is indistinguishable from a non-managed one.

1.3. Data model

We can assume without loss of generality that managed configuration is stored in a two-level key-value store.

Data model is declared as a map where each key is a configured origin and the value is a

<code>record<DOMString, object></code>

1.4. Data integrity verification

There is no managed configuration verification mechanism defined in the specification, which implies that the website should assume that the configuration could be tampered with, stolen or be replayed on a non-managed device.

Alternative security measures should be put in place by the website itself.

2. Extensions to the Navigator interface

[
  SecureContext
] partial interface Navigator {
  [SecureContext, SameObject]
  readonly attribute NavigatorManagedData managed;
};

2.1. managed attribute

3. NavigatorManagedData interface

[
  SecureContext,
  Exposed=Window
] interface NavigatorManagedData : EventTarget {
  // Managed Configuration API.
  Promise<record<DOMString, object>> getManagedConfiguration(sequence<DOMString> keys);
  attribute EventHandler onmanagedconfigurationchange;
};

Methods on this interface typically complete asynchronously, queuing work on the managed data task source.

3.1. getManagedConfiguration() method

{
   "interactable" : "false",
   "deviceType" : "map"
}

navigator.managed.getManagedConfiguration(["interactable"])
 .then(function(result) {
     // result = { “interactable” : “false” }
     // Process the value of the key.
});

navigator.managed.getManagedConfiguration(["interactable","deviceType","theme"])
 .then(onSuccess, function(error) { 
      console.log(error.name); // Will print "NotAllowedArror");
});

The getManagedConfiguration(keys) method steps are:

1. Let promise be a new promise.

2. Run the following steps in parallel:

   1. Let map be the data model configured by the device administrator.

   2. Let origin be the relevant global object of this's associated Document's origin.

      NOTE: Third-party contexts have access to the same configuration values as if they were the top-level document.

   3. If there is no entry in the map with key equal to origin, reject promise with a NotAllowedError DOMException.

   4. Create an empty IDL record record.

   5. For each key of the keys, if there is a record with key key in map[origin], add an attribute to record with key as the key and map[origin][key] as the value.

   6. Queue a global task on the relevant global object of this using the managed data task source to resolve promise with record.

3. Return promise.

3.2. onmanagedconfigurationchange attribute

navigator.managed.addEventListener("managedconfigurationchange",
 function() { 
     // Whenever something changes in the configuration, this method is
     // called.
});

onmanagedconfigurationchange is an event handler IDL attribute for the managedconfigurationchange event type.

When any of the configuration values under the origin-level key changes for an origin origin, run the following steps:

1. For each instance data of NavigatorManagedData:

   1. Let document be data’s relevant global object's associated Document.

   2. If document is fully active and document’s origin is equal to origin, fire an event named managedconfigurationchange at data with no value associated with it.

4. Security considerations

In accordance with the modern security practices, the configuration data is designed to be isolated by origin and available to secure contexts only, thus preventing other websites from accessing it.

5. Privacy considerations

Using this API, websites will be capable of identifying managed environments among other non-managed ones. However, this is only possible for web applications which are explicitly configured by the device administrator, which is the whole purpose of this API. Administrator consent for this identification is assumed.

The managed configuration is not exposed to users in anonymous contexts and behaves as if the current origin was not managed.