BlackBerry Access

Administration Guide

3.4

2022-06-01Z

||2

Contents

What is BlackBerry Access?..............................................................................5

Getting started with BlackBerry Access............................................................ 6

System requirements............................................................................................................................................. 6

MakeBlackBerry Accessavailable to users inBlackBerry UEM............................................................. 9

Making BlackBerry Access available to users in Good Control.............................................................. 9

Configuring BlackBerry Access app settings.......................................................................................................9

ConfigureBlackBerry Accessapp settings inBlackBerry UEM...............................................................9

Configure BlackBerry Access app settings in Good Control.................................................................10

BlackBerry Access app configuration settings.......................................................................................10

Configuring theBlackBerry Dynamics Launcher............................................................................................... 29

Adding the work app catalog to theBlackBerry Dynamics Launcher...................................................29

Whitelist theBlackBerry UEM App Catalogin theBlackBerry DynamicsConnectivity profile........................ 30

Configure single sign-on for BlackBerry Access in Good Control....................................................................30

Refreshing PAC configuration on devices.............................................................................................. 36

PAC file FAQ..............................................................................................................................................37

Configure RSA SecurID soft token authentication............................................................................................ 38

Configure an RSA SecurID application policy in BlackBerry UEM.........................................................39

Configure an RSA SecurID application policy in Good Control............................................................. 39

Kerberos authentication support........................................................................................................................ 39

Mapping domains to Kerberos realms................................................................................................... 40

Managing certificates.......................................................................................................................................... 41

Verify that BlackBerry Access can use certificates in BlackBerry UEM............................................... 41

Verify that BlackBerry Access can use certificates in Good Control....................................................42

Upload certificates for users inBlackBerry UEM................................................................................... 42

Send device commands to BlackBerry Access in Good Control.......................................................... 44

||iii

Secure storage of browsing activity........................................................................................................45

SSL and TLS..............................................................................................................................................45

NTLMv2 authentication............................................................................................................................ 45

HTTP basic authentication.......................................................................................................................45

User passwords........................................................................................................................................ 46

Video support....................................................................................................................................................... 46

Video support FAQ....................................................................................................................................46

Configuring allowed Internet domains............................................................................................................... 47

Changing communications protocols.................................................................................................................48

Configure a compliance rule for Windows antivirus detection in Good Control............................................. 51

Configure support for FQDN resolution in Good Control..................................................................................51

Troubleshooting.............................................................................................. 52

Diagnostics............................................................................................................................................................52

Generate a diagnostics report oniOSdevices.......................................................................................52

Generate a diagnostics report onAndroiddevices................................................................................52

Troubleshoot issues using theBlackBerry Accessconsole.............................................................................52

Upload log files to BlackBerry Support.............................................................................................................. 53

Troubleshoot connectivity issues....................................................................................................................... 53

Troubleshoot routing issues................................................................................................................................53

Legal notice.................................................................................................. 111

||iv

What is BlackBerry Access?

BlackBerry Access is a secure browser that allows users to access your organization's intranet and business

applications through the work firewall, without using a VPN, on Android, iOS, Windows, and macOS devices.

BlackBerry Access is part of the suite of BlackBerry Dynamics mobile productivity apps. You deploy and manage

BlackBerry Access using BlackBerry UEM or a standalone Good Control server. Both solutions give you the ability

to configure app settings to meet the needs and standards of your organization.

The features offered by BlackBerry Access:

Feature Description

BlackBerry Access also supports single sign-on with Kerberos Constrained

Delegation across realms and RSA soft token generation.

Intuitive browser features BlackBerry Access provides an intuitive interface that makes it easy to

download content, set bookmarks, and browse in multiple tabs. BlackBerry

Access for iOS also captures and saves web clips, and allows users to view

streaming video with intuitive player controls.

App deployment BlackBerry Access supports pop-ups that streamline the deployment of web

apps, including Cisco WebEx, Salesforce, and custom-developed apps. You

can deploy your organization's HTML5 desktop apps securely, and can provide

users with offline access to those apps.

|What is BlackBerry Access?|5

Getting started with BlackBerry Access

To use BlackBerry Access, your organization must meet the following requirements:

Item Requirement

Management solution One of the following:

• BlackBerry UEM, version 12.6 MR1 or later

Device OS For device OS compatibility, see the Mobile/Desktop OS and Enterprise

Applications Compatibility Matrix.

You can use either BlackBerry UEM or Good Control to manage BlackBerry Access. If you have not configured

your BlackBerry UEM or Good Control environment, you must complete configuration tasks before you can

Good Control • Although it is recommended that you use BlackBerry UEM, if you do not

For devices that are not MDM managed, users can download BlackBerry Access from the Google Play store or

App Store. Using BlackBerry UEM or Good Control, you provide users with an access key to activate BlackBerry

Access (see Generate access keys, activation passwords, or QR codes for BlackBerry Dynamics apps).

Using BlackBerry UEM or Good Control, you provide users with an access key to activate BlackBerry Access (see

Generate access keys, activation passwords, or QR codes for BlackBerry Dynamics apps).

When users install BlackBerry Access for Windows or BlackBerry Access for macOS, BlackBerry Work is also

installed as an integrated web extension for BlackBerry Access.

Before you deploy BlackBerry Access for Windows or BlackBerry Access for macOS with BlackBerry Work, note

the following prerequisites:

• Verify that the “Disable BlackBerry Work” app configuration setting is not selected (see BlackBerry Access app

• BlackBerry Work uses Microsoft Exchange Web Services instead of Microsoft Exchange ActiveSync.

• If Kerberos Constrained Delegation is enabled, users can’t enter their authentication credentials (username

Managing BlackBerry Access

organization must be entitled to useBlackBerry Accessin theBlackBerry Marketplace for Enterprise Software.

|Managing BlackBerry Access|9

profiles. If an IP address or a URL is explicitly defined

to route DIRECT, the site is allowed and routes

Connectivity profile are blocked. However, if the

iOS

• BlackBerry Access for

Windows

• BlackBerry Access for

macOS

This setting is valid only if the "Enforce strict tunnel"

loaded in native browser" setting is selected.

• BlackBerry Access for

iOS

• BlackBerry Access for

• BlackBerry Access for

• BlackBerry Access for

iOS

• BlackBerry Access for

Windows

|Managing BlackBerry Access|16

choose for client cert

authentication

websites that require a client cert.

iOS

background watermark across all application screens,

with the username and the current date and time.

Android

• BlackBerry Access for

Allow SameSite cookies

feature and associated

restrictions.

This setting specifies whether to allow SameSite

cookies.

• BlackBerry Access for

iOS

Force authenticate

using NTLM over

Kerberos when NTLM

authentication is

possible to access

resources.

This setting specifies whether to force authentication

using NTML over Kerberos.

This policy is not applied when the FIPS policy is

Note: If the NTLM override policy is enabled,

BlackBerry Access will force NTLM authentication, if

the website is configured to use Kerberos/KCD and

NTLM.

Note: Use this setting only if Kerberos authentication

is not available. This setting disables Kerberos to

improve performance by preventing extra network

• BlackBerry Access for

Android

reusing saved credentials

(iOS only)

Allow JavaScript to clear

Web developers can use a JavaScript API to clear

account on a web page.

If you are using the API, when you select this option,

you then specify which domains or hosts the policy

should apply to. You can add up to 10 domains.

• BlackBerry Access for

|Managing BlackBerry Access|17

accessible or for some other reason.

The limit is 4000 characters.

• BlackBerry Access for

authentication credentials that are tied to a particular

IP address that can be treated as new tickets with

other IP addresses.

• BlackBerry Access for

iOS

Resolve short names

to full qualified domain

name (FQDN) for

Kerberos authentication

This setting specifies whether users can reach

servers by typing the unqualified domain name

instead of the FQDN for Kerberos authentication.

Enabling this setting may impact performance.

• BlackBerry Access for

Android

Disable file upload and

download on mobile

connections (Windows

Only)

This setting specifies whether files can be

downloaded or uploaded when users are connected

to a mobile network instead of a Wi-Fi network.

• BlackBerry Access for

Windows

Enable HTTP 2.0 Support This setting specifies whether HTTP 2.0 is supported

in BlackBerry Access.

• BlackBerry Access for

Android

• BlackBerry Access for

iOS

Enable Web Proxy This setting specifies whether BlackBerry Access can

communicate through a web proxy server.

• BlackBerry Access for

Android

|Managing BlackBerry Access|18

from the end user.

If your organization uses a PAC file to define proxy

rules, you can select this setting to use the proxy

Enabling this setting will override static web proxy

settings.

iOS

• BlackBerry Access for

Windows

• BlackBerry Access for

macOS

Note: The PAC file must not be hosted on the same

server as Good Control or on the same server as

BlackBerry UEM or any of its components. This

The limit is 4000 characters.

This setting is valid only if the "Enable Web Proxy" and

"Use Proxy Auto Configuration" settings are selected.

(Full Tunnel)

enabled through a single web proxy service only.

This setting is valid only if the "Enable Web Proxy"

setting is selected.

Note: Enabling this setting overrides 'Enforce strict

tunnel' settings.

Android

• BlackBerry Access for

iOS

• BlackBerry Access for

|Managing BlackBerry Access|19

This setting is valid only if the "Use Static Web Proxy

(Full Tunnel)" setting is selected.

iOS

• BlackBerry Access for

Windows

• BlackBerry Access for

macOS

Use HTTPS web proxy

tunnel for above host

The HTTPS proxy can be specified either as a static

proxy or through PAC:

• BlackBerry Access for

Android

• BlackBerry Access for

iOS

• BlackBerry Access for

Windows

• BlackBerry Access for

macOS

Enable PAC proxy check

for all the sub-resources

You can use this setting to enforce PAC processing

without caching.

Selecting this setting has an impact on the

performance of your organization’s environment.

It is recommended to use this feature for special

circumstances only.

• BlackBerry Access for

Android

• BlackBerry Access for

iOS

• BlackBerry Access for

Windows

• BlackBerry Access for

macOS

Setting Description Applies to

Token

prompted for an RSA SecurID PIN.

This setting is valid only if the "Enable RSA SecurID"

setting is selected.

Android

• BlackBerry Access for

iOS

Token File Password

Retry Count

This setting specifies the number of times that a user

can enter an incorrect RSA SecurID PIN before they

are locked out.

This setting is valid only if the "Enable RSA SecurID"

setting is selected.

• BlackBerry Access for

Android

|Managing BlackBerry Access|20

record requests are sent to this address.

This setting is valid only if the "Enable RSA SecurID"

setting is selected.

iOS

Token Request CC Email

This setting specifies the email address that should

• BlackBerry Access for

This setting is valid only if the "Enable RSA SecurID"

setting is selected.

Setting Description Applies to

Allow user to upload This setting specifies whether users can upload files

to web pages in BlackBerry Access. Files can have a

• BlackBerry Access for

Android

• BlackBerry Access for

iOS

Allow user to take new

photos/videos and

This setting specifies whether users can take photos

and videos and upload the photos and videosto a

• BlackBerry Access for

Android

• BlackBerry Access for

iOS

Allow user to select

existing photos/videos to

upload

This setting specifies whether users can upload

existing photos and videos from their photo libraries

to a web page. Files can have a maximum size of 20

• BlackBerry Access for

Android

from file providers to

upload

from other file apps. Files can have a maximum size

of 20 MB.

Android

• BlackBerry Access for

iOS

|Managing BlackBerry Access|21

services such as Zoom and Webex.

Note: WebRTC traffic is not routed through the

BlackBerry Dynamics secure tunnel regardless of the

goes direct to the internet. Also, Connectivity profile

to third-party native apps on the user's device. You

can allow and disallow specific apps by app ID.By

default, this setting is not selected.

• If you select "Allow exporting to only these apps",

but do not specify one or more app IDs, the "Share"

option is not available and users are restricted

and specify one or more app IDs, users can

sharefiles to the specifiedapps.When users try to

share a file to an app that is not listed, they receive

an error message.

• If you select "Block exporting to only these

apps",but do not specify one or more app IDs,

users can share files toapps of their choice.

share files to the specified apps.

Dynamics apps content.

|Managing BlackBerry Access|22

instead.

Work uses autodiscovery methods to locate the EWS

server.

an email domain and the value designates the URL

for the EWS endpoint for that domain.Using this

method, administrators can assign multiple users

with different EWS endpoints to the same application

• Single value: blackberry.com=http://

EWS URL Resolution:at the INFO log level.

Support

Kerberos constrained delegation.

Windows

|Managing BlackBerry Access|23

macOS

ClassificationMarkings

classification markings, such as INTERNAL,

CONFIDENTIAL, NO FORWARD, and/or NO REPLY.If

Windows

• BlackBerry Access for

|Managing BlackBerry Access|24

recipient's email domain

is unauthorized

domain that is not authorized. If selected, specify

email domains you want to authorize in the Authorize

domains appear in purple text.

macOS

Default encryption

algorithm

This setting specifies the algorithm to use for

encrypting sent messages.

• BlackBerry Access for

Windows

• BlackBerry Access for

macOS

Enable Revocation

Checking

This setting allows you to setrevocation checking

of all certificates used for signing/encryption and

signing verification/decryption of S/MIME messages.

• When you select this box, Use AIA extension in

certificate if present is selected by default.

• BlackBerry Access for

Windows

• BlackBerry Access for

macOS

|Managing BlackBerry Access|25

2. Enable the User Agent in Active Directory Federation Services. By default, Active Directory Federation Services

A work network can have complex traffic flows between local networks, connected vendor and partner networks,

and the Internet. DNS domains are often split between internal and Internet hosts that require complex routing. A

PAC file is an efficient way to manage a complex proxy infrastructure.

• A PAC file locks down theBlackBerry AccessLAN egress configuration

• A PAC file provides a flexible, easy-to-maintain, and script-driven method of controlling the routing of web

|Managing BlackBerry Access|32

• A PAC file can include code that handles proxy load distribution and failover

• A PAC file can be stored and updated in a central location, instead of distributed on multiple servers and

Note:

• It is a best practice to keep the PAC file size under 1 MB to ensure proper performance.

• The return values in the PAC file must not contain spaces or newline characters.

• The PAC file must not be hosted on the same server asGood Controlor on the same server asBlackBerry

PAC files should start with a clear and concise coding methodology. You can achieve the same result

|Managing BlackBerry Access|33

|Managing BlackBerry Access|34

5. Click Good Access.

6. Click the Network tab.

|Managing BlackBerry Access|35

7. Select the Enable Web Proxy option and enter the fully qualified PAC file location.

11.For the BlackBerry Dynamics subsystem to route traffic to a proxy resolved by the PAC file, every proxy server

12.For on-premises deployments, verify that Strict Tunnel is enabled by repeating Steps 1 and 2 above and then

enter an IP or Hostname to check how the currently applied PAC file resolves it.

You can ensure that the latest PAC configuration has been pushed to all devices by forcing a policy refresh of the

BlackBerry Access policies and PAC settings in either BlackBerry UEM or Good Control.

If you have changed a policy and want to force BlackBerry UEM to send updates, including refreshing the PAC

files on devices, perform the following steps in BlackBerry UEM:

1. On the menu bar, click Apps.

2. Click the BlackBerry Access app.

3. On the BlackBerry Dynamics tab, in the App configuration table, click the app configuration that you want to

The Good Control server sends policy updates to all client devices when the policies have been changed.

|Managing BlackBerry Access|36

If you have changed a policy and want to force Good Control to send updates, including refreshing the PAC files

on devices, perform the following steps in Good Control:

2. Click the policy set that you want to configure.

3. Click the Apps tab.

5. Scroll to find the entry for BlackBerry Access and click to expand.

6. Click the General tab.

8. Enter the date and time in either 24 hour format or 12 hour format. For example, 02-16-2017 12:04AM (12-

9. Click Update.

If a PAC policy is mentioned but the PAC file can't be downloaded, BlackBerry Access doesn't allow the browser

device starts receiving the PAC file, the previous PAC file is replaced with the new one. After it is downloaded, the

data is stored in a persisted file and it's not downloaded again unless a new policy is pushed by Good Control.

For Android devices, the PAC file is downloaded only at the time the user tries to load a webpage. When it's

downloaded, the PAC data is stored in memory (not persisted) and not downloaded again until either the policy is

updated, the app is restarted, or whenever the network changes. The PAC file is downloaded again when a user

accesses a webpage after restarting the device or when network changes occur.

You can use the "Enable PAC proxy check for all the sub-resources" app setting to enforce PAC processing

without caching. Setting this app setting has an impact on the performance of your organization’s environment.

It's recommended to use this feature for special circumstances only.

|Managing BlackBerry Access|37

• The PAC file returns an empty value. In the case of computer browsers, they fall back to a connection without

• None of the web proxies returned by the PAC files are whitelisted in Good Control client connections. For more

• The PAC URL is invalid, is not whitelisted, or the PAC URL couldn't be connected to. For more information, see

• Manual proxy is set but the proxy details haven't been configured. For more information, see Configure PAC

BlackBerry Access for iOS and Android devices supports RSA SecurID soft token authentication. The software

4. The seed record must be delivered in an .sdtid file or a Compressed Token Format URL. The user imports the

5. A user that has BlackBerry Access already activated on their device opens the email message and clicks the

After you finish:

|Managing BlackBerry Access|38

4. Click the RSA tab.

5. Select the Enable RSA SecurID checkbox.

6. BlackBerry Access must prompt a PINPAD software token user to enter their PIN in order to generate an RSA

7. Enter your RSA Authentication Manager administrator’s email address in the RSA Administrator Email

8. If you want to CC a recipient each time a BlackBerry Access user requests an RSA SecurID seed record, enter

1. In the Good Control console, click Policy Sets.

8. Enter your RSA Authentication Manager administrator’s email address in the RSA Administrator Email

9. If you want to CC a recipient each time a BlackBerry Access user requests an RSA SecurID seed record, enter

10.Click Update.

BlackBerry Access fully supports Kerberos authentication. Kerberos authentication is an integral part of Microsoft

Active Directory implementations that has increasingly become a centerpiece of enterprise-level interoperability.

It provides secure user authentication through the Active Directory domain controller, which maintains the user

Service and the TGS.

|Managing BlackBerry Access|39

When they log in to your network, users must negotiate access by providing a login name and password that's

verified by the AS portion of the KDC within their domain. The KDC has access to the Active Directory user

account information. After a user is authenticated, the user is granted a TGT that's valid for the local domain. The

TGT is cached on the device, which uses it to request sessions with services throughout the network. You can

configure the TGT’s default expiration.

In addition, BlackBerry Access is certified for Kerberos Constrained Delegation, a BlackBerry Dynamics platform

feature that lets domain administrators restrict the network resources that a service trusted for delegation can

access by limiting the scope where application services can act on a user’s behalf. When configured, Kerberos

Constrained Delegation restricts which front-end service accounts can delegate to their back-end services. By

supporting constrained delegation across domains, services can be configured to use constrained delegation to

authenticate to servers in other domains rather than using unconstrained delegation. This provides authentication

support for across-domain service solutions by using an existing Kerberos infrastructure without needing to trust

front-end services to delegate to any service.

When a client attempts to access a service running on a particular server, it knows the name of the service (host)

By default, the name of the realm is taken to be the DNS domain name of the server in uppercase letters.

Example Domain Name EXAMPLE Kerberos REALM NAME

server01.example.com EXAMPLE.COM

server01.hq.example.com HQ.EXAMPLE.COM

In many configurations, this is sufficient, but in others, the derived realm name might not be the name of a

|Managing BlackBerry Access|40

5. In the field provided, enter the list of comma-separated values, using this

|Managing BlackBerry Access|41

You use connectivity profiles to specify allowed Internet domains in eitherBlackBerry UEMorGood Control. You

can set up configurations that apply to your entire user base or configurations that apply only to specific user

groups.

• If you are usingBlackBerry UEM, seeCreate aBlackBerry Dynamicsconnectivity profile in the BlackBerry UEM

• If you are usingGood Control, see theGood ControlHelp content.

UsingBlackBerry UEMorGood Control, you can allow certain secure communications protocols, such as TLSv1.0

or TLSv2, for communication with client devices.

You should be careful when you disable protocols. Check with your organization's IT staff to find out which

protocols can be safely disabled. Otherwise, you might disable a protocol that's used on your network, and this

can disrupt the secure handshake that's required betweenBlackBerry UEMorGood Controland users' devices,

and users may receive a “Page Not Found” message.

BlackBerry Access for iOShas its own application policy that controls which communications protocol to use.

• If you are usingBlackBerry UEM, seeConfiguringBlackBerry UEMto make TLS/SSL connections toExchange

WebRTC trafficcan often have high bandwidth demands. For this reason, BlackBerry recommends routing this

traffic directly.

• On the Security tab of the BlackBerry Access app configuration policy, clear the Enforce Strict Tunnel

• Configure the BlackBerry Dynamics Connectivity profile to route traffic directly to the WebRTC destination, as

|Managing BlackBerry Access|48

Route WebRTC traffic through BlackBerry Proxy

If the WebRTC destination is notdirectly accessible over the internet, or the traffic is required to route through a

BlackBerry Proxy cluster, take the following items into consideration:

• Ensure that enough BlackBerry Proxy servers are installed to handle the load generated by the WebRTC traffic.

• This configuration supportsonlyTCP-based WebRTC connections. BlackBerry Proxy servers support only TCP

By default, BlackBerry Access opens only HTTP and HTTPS URL schemes. You can use the "Enable 3rd Party

Applications" and "Enter comma separated URL schemes" app settings in BlackBerry UEM or Good Control to

allow users to open custom URL schemes supported by third-party apps. For more information about these app

3. Go to the BlackBerry Access console.

4. Look for the error message for the blocked URL scheme.

|Managing BlackBerry Access|49

When aBlackBerry Accessuser visitsa website,BlackBerry Accesssends its user agent string to the server

that hosts the website. The user agent string contains tokens that provide information, such as the browser

description, operating system, and current browser mode, in the HTTP request headers. The website server may

use this information in the user agent string to provide content tailored to mobile browsers.

The user agent string does not include any identifiable tokens to indicate that the browser isBlackBerry Access.

Toadd "GoodAccess" or "Good Access" and the version information of theBlackBerry Accessapp to the user

agent string, enable the "IdentifyBlackBerry Accessin User Agent" setting on the General tab of theBlackBerry

Accessapp config inBlackBerry UEMor in the App Specific Policy of the assigned Policy Set inGood Control.

• BlackBerry Access for Android:

• BlackBerry Access for iOS:

• BlackBerry Access for Windows:

• BlackBerry Access for macOS:

The following are examples of user agent strings when the setting is enabled:

|Managing BlackBerry Access|50

When you use BlackBerry Access with the Good Control cloud configuration, intranet servers (resources on your

internal network) aren't accessible.

In on-premises instances of Good Control, you have access to a Good Proxy server, which must be configured to

allow access from outside your organization's firewall. However, in Good Control Cloud, there's no administrator-

accessible Good Proxy server because you don't configure servers, ports, web proxies, or other the hardware or

network settings. You can't configure access to an intranet in Good Control Cloud because there are multiple

distributed intranets that belong to different organizations. For security reasons, these intranets can't be part of

the shared cloud configuration.

You can enable theBlackBerry Analyticsfeature for your users if you want to capture events inBlackBerry

Analytics, visitBlackBerry Help and Manuals: BlackBerry Analytics.

|Managing BlackBerry Access|51

Troubleshooting

If a user is reporting an issue, you can ask them to perform app diagnostics.

You can use diagnostic tools to check the connection between BlackBerry Access and BlackBerry Proxy and other

5. Look at the displayed messages to see if they indicate what the problem is.

If requested by BlackBerry Support, you can upload log files to help troubleshoot issues that your users are having

with BlackBerry Dynamics apps.

Provide the following instructions to users:

1.

• PAC:A PAC file is specified in theBlackBerry Accessapp configuration. When a PAC is configured,BlackBerry

• Web Proxy Route = BBP:The proxy server's URL is configured to route through aBlackBerry Proxycluster

• Web proxy route = DIRECT:The proxy server's URL is configured to route directly based on theBlackBerry

Host route = BBP

No proxy

Host route =

DIRECT

Manual proxy

Host route = BBP

Web proxy route =

BBP

Manual proxy

Host route =

DIRECT

Manual proxy

Host route = BBP

DIRECT

DIRECT

PAC returns

DIRECT

PAC returns PROXY

Web proxy route =

BBP

PAC returns PROXY

Host route =

DIRECT

BBP

PAC returns PROXY

Host route = BBP

Web proxy route =

DIRECT

PAC returns PROXY

Host route =

Depending on the routing configuration, the DNS resolution and the source IP address will differ. The following

table describes which endpoint makes the DNS calls and which endpoint is considered the source IP address

Host route = DIRECT

Strict tunnel = On

TheBlackBerry

Proxyresolves the IP

address of the host.

The IP address of

theBlackBerry Proxyis

used.

Host route = DIRECT

Strict tunnel = Off

TheBlackBerry

The IP address of the

Feature support

Feature Description Applies to

Cookies • Persistent cookies

• Nonpersistent cookies

• BlackBerry Access for

Android

• BlackBerry Access for

iOS

• BlackBerry Access for

Windows

Navigation return to HTML attachment • BlackBerry Access for

Android

Maximum size of attachment is 3 MB • BlackBerry Access for

Android

• BlackBerry Access for

iOS

Long tap on attachment • BlackBerry Access for

iOS

HTML attachments

No support for child pages or resources (relative links

from the parent page)

• BlackBerry Access for

Android

is loaded in the browser. IfBlackBerry Accesscan't

detect an<audio>tag, the audio playback isn't

secured.

Fingerprint

authentication

SamsungPass for user authentication using

fingerprints. You can use the same application

policies that you use to manageAndroidfingerprint

authentication forSamsungPass.

• BlackBerry Access for

Android

step attribute Supported

stepUp() method Supported

min attribute Supported

max attribute Supported

step attribute Supported

stepDown() method Supported

valueAsNumber() method Supported

input type=range Supported

Minimal element Supported Supported

Custom user-interface Supported

stepDown() method Supported

stepUp() method Supported

|Browser support for HTML5 and CSS3|64

input type=color Unsupported

Custom user-interface Unsupported

width property Supported

height property Supported

input type=file Supported (except for

Minimal element Supported Supported

files property Supported

textarea Supported

Minimal element Supported Supported

maxlength attribute Supported

wrap attribute Supported

Minimal element Supported Supported

|Browser support for HTML5 and CSS3|65

disabled attribute Supported

Minimal element Supported Unsupported

Minimal element Supported Supported

progress Supported

Minimal element Supported Supported

meter Supported

Fields

Field validation Supported

pattern attribute Supported

required attribute Supported

formEnctype property on fields Supported

formMethod property on fields Supported

|Browser support for HTML5 and CSS3|66

formTarget property on fields Supported

Other attributes Supported

:valid selector Supported

:invalid selector Supported

:optional selector Supported

:required selector Supported

:out-of-range selector Supported

:read-write selector Supported

:read-only selector Supported

Events Supported

Form validation Supported

checkValidity method Supported

|Browser support for HTML5 and CSS3|67

User interaction

Attributes Unsupported

ondragover event Unsupported

ondragleave event Unsupported

ondragend event Unsupported

ondrop event Unsupported

Editing elements Supported

contentEditable attribute Supported

isContentEditable property Supported

Editing documents Supported

queryCommandEnabled method Supported

queryCommandIndeterm method Supported

|Browser support for HTML5 and CSS3|68

queryCommandsupporteded method Supported

Spellcheck Supported

Application Cache Supported

Custom scheme handlers Unsupported

Custom content handlers Unsupported

Custom search providers Supported

Sandboxed iframe Supported

Seamless iframe Unsupported

iframe with inline contents Supported

Various

Related specifications

Location and Orientation

|Browser support for HTML5 and CSS3|69

Communication

Server-Sent Events Supported

Files

File API Supported

API：

Storage

Session Storage Unsupported

Secure Local Storage wit persistence Supported

IndexedDB Unsupported

Web SQL Database Unsupported

Workers

Notifications

|Browser support for HTML5 and CSS3|70

Other

Text selection Supported

1

Full screen Supported Supported

Pointer Lock Supported Supported

window.requestAnimationFrame Supported

1

Feature list Tags

BlackBerry Access for

iOS

Score 410

Parsing rules 10

HTML5 tokenizer Supported

HTML5 tree building Supported

SVG in text/html Supported

|Browser support for HTML5 and CSS3|71

canvas element Supported

Text Supported

Ogg Theora Supported Unsupported

WebM Supported Unsupported

WebM Supported with VP9 Supported Unsupported

Audio 20

PCM audio Supported Supported

AAC Supported Supported

MP3 Supported Supported

Ogg Vorbis Supported Unsupported

New or modified elements

section element Supported

|Browser support for HTML5 and CSS3|72

nav element Supported

aside element Supported

reversed attribute on the ol element Supported

Text-level semantic elements partially Supported

download attribute on the a element Unsupported

ping attribute on the a element Supported

ruby, rt and rp elements Supported

time element Unsupported

wbr element Supported

Interactive elements partially Supported

menu element of type toolbar Unsupported

menu element of type context Unsupported

|Browser support for HTML5 and CSS3|73

formAction property on fields Supported

formMethod property on fields Supported

placeholder attribute Supported

multiple attribute Supported

dirName attribute Supported

CSS selectors Supported

:invalid selector Supported

:optional selector Supported

:required selector Supported

:in-range selector Supported

oninput event Supported

onchange event Supported

|Browser support for HTML5 and CSS3|80

Forms Supported

checkValidity method Supported

Events Unsupported

ondrag event Unsupported

ondragstart event Unsupported

ondragenter event Unsupported

ondragleave event Unsupported

ondragend event Unsupported

ondrop event Unsupported

HTML editing

designMode attribute Supported

APIs Supported

|Browser support for HTML5 and CSS3|81

queryCommandEnabled method Supported

queryCommandState method Supported

Microdata 0/15

Microdata Unsupported

Web applications 15/20

Application Cache Supported

Custom content handlers Unsupported

Custom search providers Unsupported

Security 15/20

Sandboxed iframe Supported

Asyncronous script execution Supported

Runtime script error reporting Supported

|Browser support for HTML5 and CSS3|82

Related specifications

Device Orientation Supported

Int16Array Supported

Uint16Array Supported

Int32Array Supported

Uint32Array Supported

Float64Array Supported

DataView Supported

Communication 33/35

Cross-document messaging Supported

Document response type Supported

Array buffer response type Supported

|Browser support for HTML5 and CSS3|83

Files 10

File

Directories and System Unsupported

Web Workers Supported

Shared Workers Supported

Local multimedia 0/10

Access the webcam Unsupported

Web Notifications Unsupported

Other 8/10

Page Visibility Unsupported

Text selection Supported

Web Audio API Supported

Video and Animation

3/10

|Browser support for HTML5 and CSS3|84

Pointer Lock Supported Unsupported

These media formats may be rendered by invoking native device players when device is connected to corporate

Feature list Tags

Score 504 of 555

Parsing rules

HTML5 tokenizer Supported

HTML5 tree building Supported

Video

video element Supported

Audio track selection Unsupported

Video track selection Unsupported

Subtitle Supported Supported

MPEG-4 Supported Unsupported

H.264 Supported Unsupported

H.265 Supported Unsupported

|Browser support for HTML5 and CSS3|85

WebM Supported with VP9 Supported Supported

audio element Supported

Elements

Embedding custom non-visible data Supported

New or modified elements

section element Supported

nav element Supported

article element Supported

aside element Supported

hgroup element Supported

figcaption element Supported

reversed attribute on the ol element Supported

|Browser support for HTML5 and CSS3|86

download attribute on the a element Supported

mark element Supported

menu element of type toolbar Unsupported

menu element of type popup Unsupported

dialog element Unsupported

Global attributes or methods

Dynamic markup insertion

outerHTML property Supported

insertAdjacentHTML function Supported

Forms

input type=search Supported

Minimal element Supported Supported

|Browser support for HTML5 and CSS3|87

Minimal element Supported Supported

Minimal element Supported Supported

Custom user-interface Unsupported

Value sanitization Unsupported

min attribute Unsupported

max attribute Unsupported

stepDown() method Unsupported

stepUp() method Unsupported

valueAsDate()mothen Unsupported

valueAsNumber() method Unsupported

min attribute Supported

max attribute Supported

|Browser support for HTML5 and CSS3|88

stepDown() method Supported

valueAsDate()mothen Supported

max attribute Unsupported

step attribute Unsupported

stepDown() method Unsupported

stepUp() method Unsupported

valueAsNumber() method Unsupported

input type=time Supported

Minimal element Supported Supported

Custom user-interface Supported

stepDown() method Supported

stepUp() method Supported

|Browser support for HTML5 and CSS3|89

Various

Asyncronous script execution Supported

Cross-document messaging

Server-Sent Events Supported

XMLHttpRequest Level 2 Supported

Upload files Supported

Document response type Supported

Array buffer response type Supported

Blob response type Supported

Files

API：

Secure Local Storage with persistence Supported

IndexedDB Unsupported

|Browser support for HTML5 and CSS3|96

Workers

Shared Workers Supported

Text selection Supported

Scroll into view Supported

Mutation Observer Supported

Experimental

Web Audio API Unsupported

Video and Animation

1

Full screen Supported Supported

Pointer Lock Supported Supported

1

|Browser support for HTML5 and CSS3|97

Feature list Tags

BlackBerry Access for

Windows

Score 504 of 555

<!DOCTYPE html> triggers standards mode Supported

HTML5 tokenizer Supported

HTML5 tree building Supported

MathML in text/html Supported

Video

video element Supported

Audio track selection Unsupported

Audio track selection Unsupported

Subtitle Supported Supported

Poster image Supported Supported

WebM Supported with VP9 Supported Supported

Audio

|Browser support for HTML5 and CSS3|98

Ogg Vorbis Supported Supported

WebM Supported Supported

article element Supported

aside element Supported

hgroup element Supported

header element Supported

Grouping content elements

figure element Supported

figcaption element Supported

reversed attribute on the ol element Supported

ruby, rt and rp elements Supported

time element Unsupported

|Browser support for HTML5 and CSS3|99

Interactive elements

summary element Supported

outerHTML property Supported

insertAdjacentHTML function Supported

Forms

Field types

Minimal element Supported Supported

Selection Direction Supported

input type=search Supported

Minimal element Supported Supported

Field validation Supported

input type=email Supported

|Browser support for HTML5 and CSS3|100

Field validation Supported

Minimal element Supported Unsupported

stepUp() method Unsupported

valueAsDate()mothen Unsupported

valueAsNumber() method Unsupported

input type=month Supported

Custom user-interface Supported

Value sanitization Supported

min attribute Supported

max attribute Supported

valueAsNumber() method Supported

input type=week Unsupported

|Browser support for HTML5 and CSS3|101

Custom user-interface Unsupported

min attribute Unsupported

input type=time Supported

Minimal element Supported Supported

Custom user-interface Supported

Value sanitization Supported

max attribute Supported

step attribute Supported

stepDown() method Supported

stepUp() method Supported

Custom user-interface Supported

Value sanitization Supported

|Browser support for HTML5 and CSS3|102

max attribute Supported

stepDown() method Supported

Field validation Supported

min attribute Supported

max attribute Supported

step attribute Supported

stepUp() method Supported

valueAsNumber() method Supported

input type=range Supported

Minimal element Supported Supported

step attribute Supported