AuthenticationPolicyManager

Kotlin |Java

public final class AuthenticationPolicyManager
extends Object

java.lang.Object
↳	android.security.authenticationpolicy.AuthenticationPolicyManager

AuthenticationPolicyManager is a centralized interface for managing authentication related policies on the device. AuthenticationPolicyManager is designed to protect Android users by integrating with apps and key system components, such as the lock screen. It is not related to enterprise control surfaces and does not offer additional administrative controls.

Secure Lock

Secure lockdown includes a set of device locking capabilities to protect users in "at risk" environments.

To use secure lock, call ERROR(/#enableSecureLockDevice) to enable it on the device. This will require the caller to have the ERROR(/android.Manifest.permission#MANAGE_SECURE_LOCK_DEVICE) permission.

To disable secure lock on the device, call ERROR(/#disableSecureLockDevice). This will require the caller to have the ERROR(/android.Manifest.permission#MANAGE_SECURE_LOCK_DEVICE) permission.

To check if the device meets the requirements to enable secure lock, call ERROR(/#getSecureLockDeviceAvailability). This will require the caller to have the ERROR(/android.Manifest.permission#MANAGE_SECURE_LOCK_DEVICE) permission.

To check if secure lock is already enabled on the device, call ERROR(/#isSecureLockDeviceEnabled). This will require the caller to have the ERROR(/android.Manifest.permission#MANAGE_SECURE_LOCK_DEVICE) permission.

Cross Device Authentication Framework

AuthenticationPolicyManager exposes a set of methods that can be used by privileged components to gate access to select functionality.

This will require the caller to have the ERROR(/android.Manifest.permission#MANAGE_CROSS_DEVICE_AUTHENTICATED_MESSAGES) permission.

Cross device access requests can be initiated on one device by calling ERROR(createCrossDeviceAuthenticationRequest(String,Executor,OutcomeReceiver)/#createCrossDeviceAuthenticationRequest(java.lang.String,java.util.concurrent.Executor,android.os.OutcomeReceiver) createCrossDeviceAuthenticationRequest(String,Executor,OutcomeReceiver)). The returned token should be transmitted to another device, via any means, and the receiving service should then use that token to call ERROR(parseCrossDeviceAuthenticationRequest(byte[],String,Executor,OutcomeReceiver)/#parseCrossDeviceAuthenticationRequest(byte[],java.lang.String,java.util.concurrent.Executor,android.os.OutcomeReceiver) parseCrossDeviceAuthenticationRequest(byte[],String,Executor,OutcomeReceiver)) before executing the request. This ensures that a common set of security checks are verified before executing the request and it decouples many form factor specific checks from the service being guarded.

Summary

Constants
`String`	`PROPERTY_CROSS_DEVICE_TRUSTED_CERTIFICATES` An optional property that applications can define in their manifest's `<application>` element on the target device (the receiver of the request) to specify trusted signing certificates for cross-device authentication requests.
`String`	`PROPERTY_CROSS_DEVICE_TRUSTED_PACKAGES` An optional property that applications can define in their manifest's `<application>` element on the originating device (the sender of the request) to specify package name aliases.

Public methods
`void`	`createCrossDeviceAuthenticationRequest(UUID associationToken, Executor callbackExecutor, OutcomeReceiver<byte[], CrossDeviceAuthenticationException> callback)` Creates a new cross-device authentication request associated with the given `CompanionDeviceManager`'s obfuscated remote device ID.

Inherited methods

From class


        
          java.lang.Object

`Object`	`clone()` Creates and returns a copy of this object.
`boolean`	`equals(Object obj)` Indicates whether some other object is "equal to" this one.
`void`	`finalize()` Called by the garbage collector on an object when garbage collection determines that there are no more references to the object.
`final Class<?>`	`getClass()` Returns the runtime class of this `Object`.
`int`	`hashCode()` Returns a hash code value for the object.
`final void`	`notify()` Wakes up a single thread that is waiting on this object's monitor.
`final void`	`notifyAll()` Wakes up all threads that are waiting on this object's monitor.
`String`	`toString()` Returns a string representation of the object.
`final void`	`wait(long timeoutMillis, int nanos)` Causes the current thread to wait until it is awakened, typically by being notified or interrupted, or until a certain amount of real time has elapsed.
`final void`	`wait(long timeoutMillis)` Causes the current thread to wait until it is awakened, typically by being notified or interrupted, or until a certain amount of real time has elapsed.
`final void`	`wait()` Causes the current thread to wait until it is awakened, typically by being notified or interrupted.

Constants

PROPERTY_CROSS_DEVICE_TRUSTED_CERTIFICATES

Added in version 37.2

public static final String PROPERTY_CROSS_DEVICE_TRUSTED_CERTIFICATES

An optional property that applications can define in their manifest's <application> element on the target device (the receiver of the request) to specify trusted signing certificates for cross-device authentication requests.

This property allows the target application to trust cross-device authentication requests originating from applications signed with different certificates. The value should be a comma-separated list of SHA-256 fingerprints of the trusted certificates and a maximum of 5 entries is supported.

Constant Value: "android.security.authenticationpolicy.CROSS_DEVICE_TRUSTED_CERTIFICATES"

PROPERTY_CROSS_DEVICE_TRUSTED_PACKAGES

Added in version 37.2

public static final String PROPERTY_CROSS_DEVICE_TRUSTED_PACKAGES

An optional property that applications can define in their manifest's <application> element on the originating device (the sender of the request) to specify package name aliases.

This property is only relevant for applications that use the cross-device authentication framework (ERROR(createCrossDeviceAuthenticationRequest(String,Executor,OutcomeReceiver)/#createCrossDeviceAuthenticationRequest(java.lang.String,java.util.concurrent.Executor,android.os.OutcomeReceiver) createCrossDeviceAuthenticationRequest(String,Executor,OutcomeReceiver))). For example, an application should use this property when the application's package name on a wearable, or any other form factor, is different than the package name on the phone.

Using these aliases does not remove the need for the applications on each device to be signed with the same certificate unless PROPERTY_CROSS_DEVICE_TRUSTED_CERTIFICATES is also used.

Constant Value: "android.security.authenticationpolicy.CROSS_DEVICE_TRUSTED_PACKAGES"

Public methods

createCrossDeviceAuthenticationRequest

Added in version 37.2

public void createCrossDeviceAuthenticationRequest (UUID associationToken, 
                Executor callbackExecutor, 
                OutcomeReceiver<byte[], CrossDeviceAuthenticationException> callback)

Creates a new cross-device authentication request associated with the given CompanionDeviceManager's obfuscated remote device ID. Callers typically get this ID from a companion application which uses AssociationInfo.getAssociationToken() to retrieve it along with other device information that will be shared with applications.

Returns an opaque token to be passed to the remote device and used as a parameter in ERROR(parseCrossDeviceAuthenticationRequest(byte[],String,Executor,OutcomeReceiver)/#parseCrossDeviceAuthenticationRequest(byte[],java.lang.String,java.util.concurrent.Executor,android.os.OutcomeReceiver) parseCrossDeviceAuthenticationRequest(byte[],String,Executor,OutcomeReceiver)) to unpack the data and run authorization checks. In most cases, applications will pass this token as a parameter to another service that will parse the token to verify the request before proceeding.

Use PROPERTY_CROSS_DEVICE_TRUSTED_PACKAGES if the application is known by another name on the remote device.

Use PROPERTY_CROSS_DEVICE_TRUSTED_CERTIFICATES if the application is signed with a different certificate on the remote device.

Using this API requires that the association has been granted a supported trust type via CompanionDeviceManager.requestDeviceTrustPairing(int, OutOfBandPairingRequest, int, Executor, TrustPairingCallback) to ensure the user is informed that cross-device actions are allowed. Untrusted associations will always fail with an error.

Parameters
`associationToken`	`UUID`: the association token of the remote device where this request will be processed. This value cannot be `null`.
`callbackExecutor`	`Executor`: the executor on which to invoke the callback. This value cannot be `null`. Callback and listener events are dispatched through this `Executor`, providing an easy way to control which thread is used. To dispatch events through the main thread of your application, you can use `Context.getMainExecutor()`. Otherwise, provide an `Executor` that dispatches to an appropriate thread.
`callback`	`OutcomeReceiver`: the receiver for the encrypted request on success, or an exception on failure. This value cannot be `null`.