Skip to main content

Deploy the Chromebook App Filter (Filter for Android) using Google Workspace

Updated

The Chromebook App Filter (also known as the Filter for Android) provides real-time filtering and seamlessly integrates with Linewize Filter, ensuring your policies are consistently applied. This article outlines the steps to install the filter using Google Workspace.

  Note

The Chromebook App Filter and the Filter for Android refer to the same product. Naming may vary depending on your region.

  Important

Progressive Web Apps (PWAs) can be filtered when the Connect for Chrome extension is also deployed. Without the extension, PWAs run directly on Chrome OS and can’t be filtered by the Chromebook App Filter (Filter for Android) alone.

Before you begin

1. Add the Qoria Filter app

  1. Sign in to the Google Workspace Admin Console.
  2. On the sidebar, go to Chrome > Apps and Extensions.
  3. Select the + button in the bottom right of the age and select Add from Google Play.
  4. Search for and select Qoria Filter.
  5. Select the app to configure its settings.
  6. Under Installation Policy, select Force Install.

2. Create a certificate

You must create a certificate to allow secure communication between devices and the Linewize Filter Appliance.

  1. Sign in to Linewize Filter.
  2. Go to Configuration > Self Service Certificates.
  3. Complete the required fields:
    • Country (C): Select a country from the list.
    • State/Province (ST): Enter your state.
    • Locality (L): Enter your city.
    • Organisation (O): Enter your school’s name.
    • Common Name (CN): Enter your school’s domain name.
    • Key size (bits): Select a key size, or use the default. Larger keys provide stronger security.
    • Validity for (days): Enter the number of days the certificate remains valid. We recommend rotating certificates every two years.
  4. Select Generate.
  5. Copy the Signing Certificate and Signing Certificate Key for use in the next step.
  6. The root certificate downloads automatically.

3. Add Managed configuration

Configure Managed settings

  1. In Google Workspace Admin Console, go to Chrome > Apps and Extensions.
  2. Select the Qoria Filter app.
  3. Under Managed configuration, enter the following JSON:
{
"LW_Mode": "Android_Companion",
"LW_DeviceId": "PHYS-SMIC-US-XXXX-XXXX",
"LW_DeviceName": "",
"LW_MacAddress": null,
"LW_Region": "syd-1",
"LW_UserName": "",
"LW_BypassDomains": null,
"LW_AuthSecret": "",
"UniqueDeviceID": "",
"SigningCertificate": "",
"SigningCertificateKey": ""
}

Required settings

All required keys must contain valid values. If any required value is missing or invalid, provisioning fails.

  • LW_Mode
    Set to Android_Companion. Sets the device to Linewize Filter mode. Don’t change this value.
  • LW_DeviceId
    The primary device ID for the Linewize Filter Appliance.
  • LW_DeviceName
    The device name for the Linewize Filter Appliance.
  • LW_Region
    The deployment region for your school. Supported values:
    • syd-1 — United States and New Zealand
    • syd-2 — Australia
    • uk-1 — Europe
  • LW_UserName
    The signed-in Chromebook user. You can use variables:
    • ${USER_EMAIL} — full email address
    • ${USER_EMAIL_NAME} — email prefix (no domain). This value must match the username format used in Linewize Filter.
  • LW_AuthSecret
    This value can be copied from the Linewize Filter under Configuration Agent Downloads Copy Preshared Key.
  • SigningCertificate
    The certificate value generated in the previous step.
  • SigningCertificateKey
    The certificate key generated in the previous step.

Optional settings

  • LW_BypassDomains 
    Comma-separated list of domains excluded from filtering and reporting.
  • LW_MacAddress 
    The Chromebook MAC address, if required during enrollment.
  • UniqueDeviceID 
    An identifier for the physical device, such as ${DEVICE_SERIAL_NUMBER}.
  1. Select Save.

4. Sync certificates

  1. In Google Workspace Admin Console.
  2. On the sidebar, go to Devices > Chrome > Settings.
  3. Find Android apps > Certificate synchronization.
  4. Turn on Use Chrome OS CA certificates in Android apps.
  5. Select Save.

5. Add the trusted certificate

The trusted certificate allows the Qoria Filter app to inspect encrypted traffic.

  1. In Google Workspace Admin Console.
  2. On the sidebar, go to Devices > Networks.
  3. Select the organizational unit (OU) that applies to your users. By default, the top-level OU is selected.
  4. Move to Certificates, then select Upload certificate.
  5. Enter a name for the certificate, then select Upload.
  6. Select the certificate file downloaded during Create a certificate.
  7. Under Certificate authority, select Enabled for Chromebook.
  8. Select Add.

6. Turn on Always-on VPN

  1. In Google Workspace Admin Console.
  2. On the sidebar, go to Devices > Chrome > Settings.
  3. Select the correct organizational unit and confirm you are on the User and browser settings tab.
  4. Move to Network and find Always-on VPN.
  5. Select Edit, choose Qoria Filter App, and select OK.
  6. Turn on Do not allow users to disconnect from a VPN manually.
  7. Select Save.