Added in API level 37.2

AuthenticationPolicyManager

class AuthenticationPolicyManager
kotlin.Any
   ↳ android.security.authenticationpolicy.AuthenticationPolicyManager

AuthenticationPolicyManager is a centralized interface for managing authentication related policies on the device. AuthenticationPolicyManager is designed to protect Android users by integrating with apps and key system components, such as the lock screen. It is not related to enterprise control surfaces and does not offer additional administrative controls.

Secure Lock

Secure lockdown includes a set of device locking capabilities to protect users in "at risk" environments.

To use secure lock, call #enableSecureLockDevice to enable it on the device. This will require the caller to have the android.Manifest.permission#MANAGE_SECURE_LOCK_DEVICE permission.

To disable secure lock on the device, call #disableSecureLockDevice. This will require the caller to have the android.Manifest.permission#MANAGE_SECURE_LOCK_DEVICE permission.

To check if the device meets the requirements to enable secure lock, call #getSecureLockDeviceAvailability. This will require the caller to have the android.Manifest.permission#MANAGE_SECURE_LOCK_DEVICE permission.

To check if secure lock is already enabled on the device, call #isSecureLockDeviceEnabled. This will require the caller to have the android.Manifest.permission#MANAGE_SECURE_LOCK_DEVICE permission.

To listen for changes in the availability or enabled / disabled status of Secure Lock Device, register a android.security.authenticationpolicy.AuthenticationPolicyManager.SecureLockDeviceStatusListener using #registerSecureLockDeviceStatusListener(java.util.concurrent.Executor,android.security.authenticationpolicy.AuthenticationPolicyManager.SecureLockDeviceStatusListener). To unregister a previously registered listener, use #unregisterSecureLockDeviceStatusListener(android.security.authenticationpolicy.AuthenticationPolicyManager.SecureLockDeviceStatusListener).

Cross Device Authentication Framework

AuthenticationPolicyManager exposes a set of methods that can be used by privileged components to gate access to select functionality.

This will require the caller to have the android.Manifest.permission#MANAGE_CROSS_DEVICE_AUTHENTICATED_MESSAGES permission.

Cross device access requests can be initiated on one device by calling #createCrossDeviceAuthenticationRequest(java.lang.String,java.util.concurrent.Executor,android.os.OutcomeReceiver). The returned token should be transmitted to another device, via any means, and the receiving service should then use that token to call #parseCrossDeviceAuthenticationRequest(byte[],java.lang.String,java.util.concurrent.Executor,android.os.OutcomeReceiver) before executing the request. This ensures that a common set of security checks are verified before executing the request and it decouples many form factor specific checks from the service being guarded.

Summary

Constants
static String

An optional property that applications can define in their manifest's <application> element on the target device (the receiver of the request) to specify trusted signing certificates for cross-device authentication requests.
static String

An optional property that applications can define in their manifest's <application> element on the originating device (the sender of the request) to specify package name aliases.
Public methods
Unit

Creates a new cross-device authentication request associated with the given android.companion.CompanionDeviceManager's obfuscated remote device ID.

Constants

PROPERTY_CROSS_DEVICE_TRUSTED_CERTIFICATES

Added in API level 37.2
static val PROPERTY_CROSS_DEVICE_TRUSTED_CERTIFICATES: String

An optional property that applications can define in their manifest's <application> element on the target device (the receiver of the request) to specify trusted signing certificates for cross-device authentication requests.

This property is only relevant for applications that use the cross-device authentication framework (#createCrossDeviceAuthenticationRequest(java.lang.String,java.util.concurrent.Executor,android.os.OutcomeReceiver)).

This property allows the target application to trust cross-device authentication requests originating from applications signed with different certificates. The value should be a comma-separated list of SHA-256 fingerprints of the trusted certificates and a maximum of 5 entries is supported.

Value: "android.security.authenticationpolicy.CROSS_DEVICE_TRUSTED_CERTIFICATES"

PROPERTY_CROSS_DEVICE_TRUSTED_PACKAGES

Added in API level 37.2
static val PROPERTY_CROSS_DEVICE_TRUSTED_PACKAGES: String

An optional property that applications can define in their manifest's <application> element on the originating device (the sender of the request) to specify package name aliases.

This property is only relevant for applications that use the cross-device authentication framework (#createCrossDeviceAuthenticationRequest(java.lang.String,java.util.concurrent.Executor,android.os.OutcomeReceiver)). For example, an application should use this property when the application's package name on a wearable, or any other form factor, is different than the package name on the phone.

Using these aliases does not remove the need for the applications on each device to be signed with the same certificate unless PROPERTY_CROSS_DEVICE_TRUSTED_CERTIFICATES is also used.

Value: "android.security.authenticationpolicy.CROSS_DEVICE_TRUSTED_PACKAGES"

Public methods

createCrossDeviceAuthenticationRequest

Added in API level 37.2
fun createCrossDeviceAuthenticationRequest(
    associationToken: UUID, 
    callbackExecutor: Executor, 
    callback: OutcomeReceiver<ByteArray!, CrossDeviceAuthenticationException!>
): Unit

Creates a new cross-device authentication request associated with the given android.companion.CompanionDeviceManager's obfuscated remote device ID. Callers typically get this ID from a companion application which uses android.companion.AssociationInfo#getAssociationToken() to retrieve it along with other device information that will be shared with applications.

Returns an opaque token to be passed to the remote device and used as a parameter in #parseCrossDeviceAuthenticationRequest(byte[],java.lang.String,java.util.concurrent.Executor,android.os.OutcomeReceiver) to unpack the data and run authorization checks. In most cases, applications will pass this token as a parameter to another service that will parse the token to verify the request before proceeding.

Use PROPERTY_CROSS_DEVICE_TRUSTED_PACKAGES if the application is known by another name on the remote device.

Use PROPERTY_CROSS_DEVICE_TRUSTED_CERTIFICATES if the application is signed with a different certificate on the remote device.

Using this API requires that the association has been granted a supported trust type via android.companion.CompanionDeviceManager#requestDeviceTrustPairing to ensure the user is informed that cross-device actions are allowed. Untrusted associations will always fail with an error.

Parameters
associationToken UUID: the association token of the remote device where this request will be processed.
This value cannot be null.
callbackExecutor Executor: the executor on which to invoke the callback.
This value cannot be null.
Callback and listener events are dispatched through this Executor, providing an easy way to control which thread is used. To dispatch events through the main thread of your application, you can use Context.getMainExecutor(). Otherwise, provide an Executor that dispatches to an appropriate thread.
callback OutcomeReceiver<ByteArray!, CrossDeviceAuthenticationException!>: the receiver for the encrypted request on success, or an exception on failure.
This value cannot be null.