title: How to secure iOS enterprise distribution using oauth on a public facing website?
body: <p>We have an enterprise distribution of an app that we would like to distribute only within our organisation.</p>
  
  <p>We've built the ipa file and the plist which points to the right places, and created the html page with the url: itms-services://?action=download&amp;url={link to our plist}.</p>
  
  <p>Our problem however is securing the distribution process. We want our employees with company owned iPads to be able to download the app while on the move (they're highly mobile). So we want to place the plist and the app on a public website which requires login via an oauth service.</p>
  
  <p>Our problem is that if we require authentication on the URLs for the app and the plist, the itms-services:// url no longer works. What happens is that the user clicks the itms-services link, and we see an un-authenticated request for the plist (which is redirected to login) followed by a "Cannot connect to {hostname}" on the device.</p>
  
  <p>At the moment, the only way I can see this working is if the ipa and the plist files are not checked for authentication. This means (I believe) that someone guessing our URLs to our plist file could create their own itms-services link and download the app without authorisation and effectively cause us to violate our agreement with Apple to only distribute to our employees.</p>
  
  <p>My question therefore is - how can I create an itms-services link that does not expose the ipa and plist files to the public? If it's relevant, the website is built using nodejs and the app is a PhoneGap app.</p>