Skip to main content

Deploy the Chromebook App Filter using Google Workspace

Updated

The Chromebook App Filter provides real-time filtering and seamlessly integrates with Linewize Filter, ensuring your policies are consistently applied. This article outlines the steps to install the Chromebook App Filter using Google Workspace.

  Important

The Chromebook App Filter can’t filter Progressive Web Apps (PWAs) because they run on Chrome OS rather than Android OS.

Before you begin

1. Add the Qoria Filter app

  1. Sign in to the Google Workspace Admin Console.
  2. On the sidebar, go to Chrome > Apps and Extensions.
  3. Select the + button in the bottom right of the age and select Add from Google Play.
  4. Search for and select Qoria Filter.
  5. Select the app to configure its settings.
  6. Under Installation Policy, select Force Install.
  7. Move down to the Managed configuration section.

2. Create a certificate

You must create a certificate to allow secure communication between devices and the Linewize Filter Appliance.

  1. Sign in to Linewize Filter.
  2. Go to Configuration > Self Service Certificates.
  3. Complete the required fields:
    • Country (C): Select a country from the list.
    • State/Province (ST): Enter your state.
    • Locality (L): Enter your city.
    • Organisation (O): Enter your school’s name.
    • Common Name (CN): Enter your school’s domain name.
    • Key size (bits): Select a key size, or use the default. Larger keys provide stronger security.
    • Validity for (days): Enter the number of days the certificate remains valid. We recommend rotating certificates every two years.
  4. Select Generate.
  5. Copy the Signing Certificate and Signing Certificate Key for use in the next step.
  6. The certificate downloads automatically.

3. Add Managed configuration

Configure Managed settings

  1. In Google Workspace Admin Console, go to Chrome > Apps and Extensions.
  2. Select the Qoria Filter app.
  3. Under Managed configuration, enter the following JSON: 
{
    "LW_Mode": "Android_Companion",
    "LW_DeviceId": "PHYS-SMIC-US-XXXX-XXXX",
    "LW_AdditionalDeviceIds": null,
    "LW_DeviceName": "",
    "LW_MacAddress": null,
    "LW_Region": "syd-1",
    "LW_UserName": "",
    "LW_BypassDomains": null,
    "LW_AuthSecret": "",
    "UniqueDeviceID": "",
    "VpnAllowedAndroidApps": "",
    "SigningCertificate": "",
    "SigningCertificateKey": ""
}

Required settings

All required keys must contain valid values. If any required value is missing or invalid, provisioning fails.

  • LW_Mode 
    Set to Android_Companion. Sets the device to Linewize Filter mode. Don’t change this value.
  • LW_DeviceId 
    The primary device ID for the Linewize Filter Appliance.
  • LW_DeviceName 
    The device name for the Linewize Filter Appliance.
  • LW_Region 
    The deployment region for your school. Supported values:
    • syd-1 — United States and New Zealand
    • syd-2 — Australia
    • uk-1 — Europe
  • LW_UserName 
    The signed-in Chromebook user. You can use variables:
    • ${USER_EMAIL} — full email address
    • ${USER_EMAIL_NAME} — email prefix (no domain) This value must match the username format used in Linewize Filter.
  • LW_AuthSecret 
    The secret key from your Linewize Filter Appliance. A Linewize Deployment Engineer provides this value.
  • SigningCertificate 
    The certificate value generated in the previous step.
  • SigningCertificateKey 
    The certificate key generated in the previous step.

Optional settings

  • LW_AdditionalDeviceIds 
    Comma-separated list of additional Linewize Filter Appliance IDs for multi-appliance deployments.
  • LW_BypassDomains 
    Comma-separated list of domains excluded from filtering and reporting.
  • LW_MacAddress 
    The Chromebook MAC address, if required during enrollment.
  • UniqueDeviceID 
    An identifier for the physical device, such as ${DEVICE_SERIAL_NUMBER}.
  • VpnAllowedAndroidApps 
    Comma-separated list of Application IDs forced through the Qoria Filter VPN. Warning: We recommend leaving this field empty. Qoria Filter automatically detects which apps require VPN routing. Only enter values if you need greater control.
  1. Select Save.

4. Sync certificates

  1. In Google Workspace Admin Console.
  2. On the sidebar, go to Devices > Chrome > Settings.
  3. Find Android apps > Certificate synchronization.
  4. Turn on Use Chrome OS CA certificates in Android apps.
  5. Select Save.

5. Add the trusted certificate

The trusted certificate allows the Qoria Filter app to inspect encrypted traffic.

  1. In Google Workspace Admin Console.
  2. On the sidebar, go to Devices > Networks.
  3. Select the organizational unit (OU) that applies to your users. By default, the top-level OU is selected.
  4. Move to Certificates, then select Upload certificate.
  5. Enter a name for the certificate, then select Upload.
  6. Select the certificate file downloaded during Create a certificate.
  7. Under Certificate authority, select Enabled for Chromebook.
  8. Select Add.

6. Turn on VPN bypass for Chrome

VPN bypass ensures that Chrome traffic continues to flow through the Linewize Connect for Chrome extension rather than the Qoria Filter VPN.

  1. In Google Workspace Admin Console.
  2. On the sidebar, go to Devices > Chrome > Settings.
  3. Select the correct organizational unit and confirm you are on the User and browser settings tab.
  4. Move to Network and find Always-on VPN URL exceptions.
  5. In the configuration field, enter: 
    *
  6. Select Save.

7. Turn on Always-on VPN

  1. In Google Workspace Admin Console.
  2. On the sidebar, go to Devices > Chrome > Settings.
  3. Select the correct organizational unit and confirm you are on the User and browser settings tab.
  4. Move to Network and find Always-on VPN.
  5. Select Edit, choose Qoria Filter App, and select OK.
  6. Turn on Do not allow users to disconnect from a VPN manually.
  7. Select Save.