blob: e2322f3e2eeb333a85b3edf3b8f01575eaf94ea3 [file] [log] [blame]
/*
* Copyright (C) 2010 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package android.app.admin;
import android.annotation.CallbackExecutor;
import android.annotation.ColorInt;
import android.annotation.IntDef;
import android.annotation.NonNull;
import android.annotation.Nullable;
import android.annotation.RequiresFeature;
import android.annotation.RequiresPermission;
import android.annotation.SdkConstant;
import android.annotation.SdkConstant.SdkConstantType;
import android.annotation.StringDef;
import android.annotation.SuppressLint;
import android.annotation.SystemApi;
import android.annotation.SystemService;
import android.annotation.TestApi;
import android.annotation.UnsupportedAppUsage;
import android.annotation.UserIdInt;
import android.annotation.WorkerThread;
import android.app.Activity;
import android.app.IServiceConnection;
import android.app.KeyguardManager;
import android.app.admin.SecurityLog.SecurityEvent;
import android.content.ComponentName;
import android.content.Context;
import android.content.Intent;
import android.content.IntentFilter;
import android.content.ServiceConnection;
import android.content.pm.ApplicationInfo;
import android.content.pm.IPackageDataObserver;
import android.content.pm.PackageManager;
import android.content.pm.PackageManager.NameNotFoundException;
import android.content.pm.ParceledListSlice;
import android.content.pm.UserInfo;
import android.graphics.Bitmap;
import android.net.ProxyInfo;
import android.net.Uri;
import android.os.Build;
import android.os.Bundle;
import android.os.Parcelable;
import android.os.PersistableBundle;
import android.os.Process;
import android.os.RemoteCallback;
import android.os.RemoteException;
import android.os.ServiceSpecificException;
import android.os.UserHandle;
import android.os.UserManager;
import android.os.UserManager.UserOperationException;
import android.os.UserManager.UserOperationResult;
import android.provider.ContactsContract.Directory;
import android.provider.Settings;
import android.security.AttestedKeyPair;
import android.security.Credentials;
import android.security.KeyChain;
import android.security.KeyChainException;
import android.security.keymaster.KeymasterCertificateChain;
import android.security.keystore.AttestationUtils;
import android.security.keystore.KeyAttestationException;
import android.security.keystore.KeyGenParameterSpec;
import android.security.keystore.ParcelableKeyGenParameterSpec;
import android.service.restrictions.RestrictionsReceiver;
import android.telephony.TelephonyManager;
import android.telephony.data.ApnSetting;
import android.util.ArraySet;
import android.util.Log;
import com.android.internal.R;
import com.android.internal.annotations.VisibleForTesting;
import com.android.internal.util.Preconditions;
import com.android.org.conscrypt.TrustedCertificateStore;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.net.InetSocketAddress;
import java.net.Proxy;
import java.security.KeyFactory;
import java.security.KeyPair;
import java.security.NoSuchAlgorithmException;
import java.security.PrivateKey;
import java.security.cert.Certificate;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.security.spec.InvalidKeySpecException;
import java.security.spec.PKCS8EncodedKeySpec;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
import java.util.concurrent.Executor;
/**
* Public interface for managing policies enforced on a device. Most clients of this class must be
* registered with the system as a <a href="{@docRoot}guide/topics/admin/device-admin.html">device
* administrator</a>. Additionally, a device administrator may be registered as either a profile or
* device owner. A given method is accessible to all device administrators unless the documentation
* for that method specifies that it is restricted to either device or profile owners. Any
* application calling an api may only pass as an argument a device administrator component it
* owns. Otherwise, a {@link SecurityException} will be thrown.
* <div class="special reference">
* <h3>Developer Guides</h3>
* <p>
* For more information about managing policies for device administration, read the <a href=
* "{@docRoot}guide/topics/admin/device-admin.html">Device Administration</a> developer
* guide. </div>
*/
@SystemService(Context.DEVICE_POLICY_SERVICE)
@RequiresFeature(PackageManager.FEATURE_DEVICE_ADMIN)
public class DevicePolicyManager {
private static String TAG = "DevicePolicyManager";
private final Context mContext;
private final IDevicePolicyManager mService;
private final boolean mParentInstance;
/** @hide */
public DevicePolicyManager(Context context, IDevicePolicyManager service) {
this(context, service, false);
}
/** @hide */
@VisibleForTesting
protected DevicePolicyManager(Context context, IDevicePolicyManager service,
boolean parentInstance) {
mContext = context;
mService = service;
mParentInstance = parentInstance;
}
/** @hide test will override it. */
@VisibleForTesting
protected int myUserId() {
return mContext.getUserId();
}
/**
* Activity action: Starts the provisioning flow which sets up a managed profile.
*
* <p>A managed profile allows data separation for example for the usage of a
* device as a personal and corporate device. The user which provisioning is started from and
* the managed profile share a launcher.
*
* <p>This intent will typically be sent by a mobile device management application (MDM).
* Provisioning adds a managed profile and sets the MDM as the profile owner who has full
* control over the profile.
*
* <p>It is possible to check if provisioning is allowed or not by querying the method
* {@link #isProvisioningAllowed(String)}.
*
* <p>In version {@link android.os.Build.VERSION_CODES#LOLLIPOP}, this intent must contain the
* extra {@link #EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME}.
* As of {@link android.os.Build.VERSION_CODES#M}, it should contain the extra
* {@link #EXTRA_PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME} instead, although specifying only
* {@link #EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME} is still supported.
*
* <p>The intent may also contain the following extras:
* <ul>
* <li>{@link #EXTRA_PROVISIONING_ACCOUNT_TO_MIGRATE}, optional </li>
* <li>{@link #EXTRA_PROVISIONING_SKIP_ENCRYPTION}, optional, supported from
* {@link android.os.Build.VERSION_CODES#N}</li>
* <li>{@link #EXTRA_PROVISIONING_ADMIN_EXTRAS_BUNDLE}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_LOGO_URI}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_MAIN_COLOR}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_SKIP_USER_CONSENT}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_KEEP_ACCOUNT_ON_MIGRATION}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_DISCLAIMERS}, optional</li>
* </ul>
*
* <p>When managed provisioning has completed, broadcasts are sent to the application specified
* in the provisioning intent. The
* {@link DeviceAdminReceiver#ACTION_PROFILE_PROVISIONING_COMPLETE} broadcast is sent in the
* managed profile and the {@link #ACTION_MANAGED_PROFILE_PROVISIONED} broadcast is sent in
* the primary profile.
*
* <p>From version {@link android.os.Build.VERSION_CODES#O}, when managed provisioning has
* completed, along with the above broadcast, activity intent
* {@link #ACTION_PROVISIONING_SUCCESSFUL} will also be sent to the profile owner.
*
* <p>If provisioning fails, the managedProfile is removed so the device returns to its
* previous state.
*
* <p>If launched with {@link android.app.Activity#startActivityForResult(Intent, int)} a
* result code of {@link android.app.Activity#RESULT_OK} implies that the synchronous part of
* the provisioning flow was successful, although this doesn't guarantee the full flow will
* succeed. Conversely a result code of {@link android.app.Activity#RESULT_CANCELED} implies
* that the user backed-out of provisioning, or some precondition for provisioning wasn't met.
*/
@SdkConstant(SdkConstantType.ACTIVITY_INTENT_ACTION)
public static final String ACTION_PROVISION_MANAGED_PROFILE
= "android.app.action.PROVISION_MANAGED_PROFILE";
/**
* Activity action: Starts the provisioning flow which sets up a managed user.
*
* <p>This intent will typically be sent by a mobile device management application (MDM).
* Provisioning configures the user as managed user and sets the MDM as the profile
* owner who has full control over the user. Provisioning can only happen before user setup has
* been completed. Use {@link #isProvisioningAllowed(String)} to check if provisioning is
* allowed.
*
* <p>The intent contains the following extras:
* <ul>
* <li>{@link #EXTRA_PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME}</li>
* <li>{@link #EXTRA_PROVISIONING_SKIP_ENCRYPTION}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_ADMIN_EXTRAS_BUNDLE}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_LOGO_URI}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_MAIN_COLOR}, optional</li>
* </ul>
*
* <p>If provisioning fails, the device returns to its previous state.
*
* <p>If launched with {@link android.app.Activity#startActivityForResult(Intent, int)} a
* result code of {@link android.app.Activity#RESULT_OK} implies that the synchronous part of
* the provisioning flow was successful, although this doesn't guarantee the full flow will
* succeed. Conversely a result code of {@link android.app.Activity#RESULT_CANCELED} implies
* that the user backed-out of provisioning, or some precondition for provisioning wasn't met.
*
* @hide
*/
@SdkConstant(SdkConstantType.ACTIVITY_INTENT_ACTION)
public static final String ACTION_PROVISION_MANAGED_USER
= "android.app.action.PROVISION_MANAGED_USER";
/**
* Activity action: Starts the provisioning flow which sets up a managed device.
* Must be started with {@link android.app.Activity#startActivityForResult(Intent, int)}.
*
* <p> During device owner provisioning a device admin app is set as the owner of the device.
* A device owner has full control over the device. The device owner can not be modified by the
* user.
*
* <p> A typical use case would be a device that is owned by a company, but used by either an
* employee or client.
*
* <p> An intent with this action can be sent only on an unprovisioned device.
* It is possible to check if provisioning is allowed or not by querying the method
* {@link #isProvisioningAllowed(String)}.
*
* <p>The intent contains the following extras:
* <ul>
* <li>{@link #EXTRA_PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME}</li>
* <li>{@link #EXTRA_PROVISIONING_SKIP_ENCRYPTION}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_LEAVE_ALL_SYSTEM_APPS_ENABLED}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_ADMIN_EXTRAS_BUNDLE}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_LOGO_URI}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_MAIN_COLOR}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_DISCLAIMERS}, optional</li>
* </ul>
*
* <p>When device owner provisioning has completed, an intent of the type
* {@link DeviceAdminReceiver#ACTION_PROFILE_PROVISIONING_COMPLETE} is broadcast to the
* device owner.
*
* <p>From version {@link android.os.Build.VERSION_CODES#O}, when device owner provisioning has
* completed, along with the above broadcast, activity intent
* {@link #ACTION_PROVISIONING_SUCCESSFUL} will also be sent to the device owner.
*
* <p>If provisioning fails, the device is factory reset.
*
* <p>A result code of {@link android.app.Activity#RESULT_OK} implies that the synchronous part
* of the provisioning flow was successful, although this doesn't guarantee the full flow will
* succeed. Conversely a result code of {@link android.app.Activity#RESULT_CANCELED} implies
* that the user backed-out of provisioning, or some precondition for provisioning wasn't met.
*/
@SdkConstant(SdkConstantType.ACTIVITY_INTENT_ACTION)
public static final String ACTION_PROVISION_MANAGED_DEVICE
= "android.app.action.PROVISION_MANAGED_DEVICE";
/**
* Activity action: launch when user provisioning completed, i.e.
* {@link #getUserProvisioningState()} returns one of the complete state.
*
* <p> Please note that the API behavior is not necessarily consistent across various releases,
* and devices, as it's contract between SetupWizard and ManagedProvisioning. The default
* implementation is that ManagedProvisioning launches SetupWizard in NFC provisioning only.
*
* <p> The activity must be protected by permission
* {@link android.Manifest.permission#BIND_DEVICE_ADMIN}, and the process must hold
* {@link android.Manifest.permission#DISPATCH_PROVISIONING_MESSAGE} to be launched.
* Only one {@link ComponentName} in the entire system should be enabled, and the rest of the
* components are not started by this intent.
* @hide
*/
@SdkConstant(SdkConstantType.ACTIVITY_INTENT_ACTION)
@SystemApi
public static final String ACTION_STATE_USER_SETUP_COMPLETE =
"android.app.action.STATE_USER_SETUP_COMPLETE";
/**
* Activity action: Starts the provisioning flow which sets up a managed device.
*
* <p>During device owner provisioning, a device admin app is downloaded and set as the owner of
* the device. A device owner has full control over the device. The device owner can not be
* modified by the user and the only way of resetting the device is via factory reset.
*
* <p>A typical use case would be a device that is owned by a company, but used by either an
* employee or client.
*
* <p>The provisioning message should be sent to an unprovisioned device.
*
* <p>Unlike {@link #ACTION_PROVISION_MANAGED_DEVICE}, the provisioning message can only be sent
* by a privileged app with the permission
* {@link android.Manifest.permission#DISPATCH_PROVISIONING_MESSAGE}.
*
* <p>The provisioning intent contains the following properties:
* <ul>
* <li>{@link #EXTRA_PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME}</li>
* <li>{@link #EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_COOKIE_HEADER}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_LABEL}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_ICON_URI}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_LOCAL_TIME} (convert to String), optional</li>
* <li>{@link #EXTRA_PROVISIONING_TIME_ZONE}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_LOCALE}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_WIFI_SSID}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_WIFI_HIDDEN} (convert to String), optional</li>
* <li>{@link #EXTRA_PROVISIONING_WIFI_SECURITY_TYPE}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_WIFI_PASSWORD}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_WIFI_PROXY_HOST}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_WIFI_PROXY_PORT} (convert to String), optional</li>
* <li>{@link #EXTRA_PROVISIONING_WIFI_PROXY_BYPASS}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_WIFI_PAC_URL}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_SUPPORT_URL}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_ORGANIZATION_NAME}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_ADMIN_EXTRAS_BUNDLE}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_USE_MOBILE_DATA, optional </li><ul>
*
* @hide
*/
@SdkConstant(SdkConstantType.ACTIVITY_INTENT_ACTION)
@SystemApi
public static final String ACTION_PROVISION_MANAGED_DEVICE_FROM_TRUSTED_SOURCE =
"android.app.action.PROVISION_MANAGED_DEVICE_FROM_TRUSTED_SOURCE";
/**
* Activity action: Starts the provisioning flow which sets up a managed device.
* Must be started with {@link android.app.Activity#startActivityForResult(Intent, int)}.
*
* <p>NOTE: This is only supported on split system user devices, and puts the device into a
* management state that is distinct from that reached by
* {@link #ACTION_PROVISION_MANAGED_DEVICE} - specifically the device owner runs on the system
* user, and only has control over device-wide policies, not individual users and their data.
* The primary benefit is that multiple non-system users are supported when provisioning using
* this form of device management.
*
* <p>During device owner provisioning a device admin app is set as the owner of the device.
* A device owner has full control over the device. The device owner can not be modified by the
* user.
*
* <p>A typical use case would be a device that is owned by a company, but used by either an
* employee or client.
*
* <p>An intent with this action can be sent only on an unprovisioned device.
* It is possible to check if provisioning is allowed or not by querying the method
* {@link #isProvisioningAllowed(String)}.
*
* <p>The intent contains the following extras:
* <ul>
* <li>{@link #EXTRA_PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME}</li>
* <li>{@link #EXTRA_PROVISIONING_SKIP_ENCRYPTION}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_LEAVE_ALL_SYSTEM_APPS_ENABLED}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_ADMIN_EXTRAS_BUNDLE}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_LOGO_URI}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_MAIN_COLOR}, optional</li>
* </ul>
*
* <p>When device owner provisioning has completed, an intent of the type
* {@link DeviceAdminReceiver#ACTION_PROFILE_PROVISIONING_COMPLETE} is broadcast to the
* device owner.
*
* <p>From version {@link android.os.Build.VERSION_CODES#O}, when device owner provisioning has
* completed, along with the above broadcast, activity intent
* {@link #ACTION_PROVISIONING_SUCCESSFUL} will also be sent to the device owner.
*
* <p>If provisioning fails, the device is factory reset.
*
* <p>A result code of {@link android.app.Activity#RESULT_OK} implies that the synchronous part
* of the provisioning flow was successful, although this doesn't guarantee the full flow will
* succeed. Conversely a result code of {@link android.app.Activity#RESULT_CANCELED} implies
* that the user backed-out of provisioning, or some precondition for provisioning wasn't met.
*
* @hide
*/
@SdkConstant(SdkConstantType.ACTIVITY_INTENT_ACTION)
public static final String ACTION_PROVISION_MANAGED_SHAREABLE_DEVICE
= "android.app.action.PROVISION_MANAGED_SHAREABLE_DEVICE";
/**
* Activity action: Finalizes management provisioning, should be used after user-setup
* has been completed and {@link #getUserProvisioningState()} returns one of:
* <ul>
* <li>{@link #STATE_USER_SETUP_INCOMPLETE}</li>
* <li>{@link #STATE_USER_SETUP_COMPLETE}</li>
* <li>{@link #STATE_USER_PROFILE_COMPLETE}</li>
* </ul>
*
* @hide
*/
@SystemApi
@SdkConstant(SdkConstantType.ACTIVITY_INTENT_ACTION)
public static final String ACTION_PROVISION_FINALIZATION
= "android.app.action.PROVISION_FINALIZATION";
/**
* Action: Bugreport sharing with device owner has been accepted by the user.
*
* @hide
*/
public static final String ACTION_BUGREPORT_SHARING_ACCEPTED =
"com.android.server.action.REMOTE_BUGREPORT_SHARING_ACCEPTED";
/**
* Action: Bugreport sharing with device owner has been declined by the user.
*
* @hide
*/
public static final String ACTION_BUGREPORT_SHARING_DECLINED =
"com.android.server.action.REMOTE_BUGREPORT_SHARING_DECLINED";
/**
* Action: Bugreport has been collected and is dispatched to {@code DevicePolicyManagerService}.
*
* @hide
*/
public static final String ACTION_REMOTE_BUGREPORT_DISPATCH =
"android.intent.action.REMOTE_BUGREPORT_DISPATCH";
/**
* Extra for shared bugreport's SHA-256 hash.
*
* @hide
*/
public static final String EXTRA_REMOTE_BUGREPORT_HASH =
"android.intent.extra.REMOTE_BUGREPORT_HASH";
/**
* Extra for remote bugreport notification shown type.
*
* @hide
*/
public static final String EXTRA_BUGREPORT_NOTIFICATION_TYPE =
"android.app.extra.bugreport_notification_type";
/**
* Notification type for a started remote bugreport flow.
*
* @hide
*/
public static final int NOTIFICATION_BUGREPORT_STARTED = 1;
/**
* Notification type for a bugreport that has already been accepted to be shared, but is still
* being taken.
*
* @hide
*/
public static final int NOTIFICATION_BUGREPORT_ACCEPTED_NOT_FINISHED = 2;
/**
* Notification type for a bugreport that has been taken and can be shared or declined.
*
* @hide
*/
public static final int NOTIFICATION_BUGREPORT_FINISHED_NOT_ACCEPTED = 3;
/**
* Default and maximum timeout in milliseconds after which unlocking with weak auth times out,
* i.e. the user has to use a strong authentication method like password, PIN or pattern.
*
* @hide
*/
public static final long DEFAULT_STRONG_AUTH_TIMEOUT_MS = 72 * 60 * 60 * 1000; // 72h
/**
* A {@link android.os.Parcelable} extra of type {@link android.os.PersistableBundle} that
* allows a mobile device management application or NFC programmer application which starts
* managed provisioning to pass data to the management application instance after provisioning.
* <p>
* If used with {@link #ACTION_PROVISION_MANAGED_PROFILE} it can be used by the application that
* sends the intent to pass data to itself on the newly created profile.
* If used with {@link #ACTION_PROVISION_MANAGED_DEVICE} it allows passing data to the same
* instance of the app on the primary user.
* Starting from {@link android.os.Build.VERSION_CODES#M}, if used with
* {@link #MIME_TYPE_PROVISIONING_NFC} as part of NFC managed device provisioning, the NFC
* message should contain a stringified {@link java.util.Properties} instance, whose string
* properties will be converted into a {@link android.os.PersistableBundle} and passed to the
* management application after provisioning.
*
* <p>
* In both cases the application receives the data in
* {@link DeviceAdminReceiver#onProfileProvisioningComplete} via an intent with the action
* {@link DeviceAdminReceiver#ACTION_PROFILE_PROVISIONING_COMPLETE}. The bundle is not changed
* during the managed provisioning.
*/
public static final String EXTRA_PROVISIONING_ADMIN_EXTRAS_BUNDLE =
"android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLE";
/**
* A String extra holding the package name of the mobile device management application that
* will be set as the profile owner or device owner.
*
* <p>If an application starts provisioning directly via an intent with action
* {@link #ACTION_PROVISION_MANAGED_PROFILE} this package has to match the package name of the
* application that started provisioning. The package will be set as profile owner in that case.
*
* <p>This package is set as device owner when device owner provisioning is started by an NFC
* message containing an NFC record with MIME type {@link #MIME_TYPE_PROVISIONING_NFC}.
*
* <p> When this extra is set, the application must have exactly one device admin receiver.
* This receiver will be set as the profile or device owner and active admin.
*
* @see DeviceAdminReceiver
* @deprecated Use {@link #EXTRA_PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME}. This extra is still
* supported, but only if there is only one device admin receiver in the package that requires
* the permission {@link android.Manifest.permission#BIND_DEVICE_ADMIN}.
*/
@Deprecated
public static final String EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME
= "android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME";
/**
* A ComponentName extra indicating the device admin receiver of the mobile device management
* application that will be set as the profile owner or device owner and active admin.
*
* <p>If an application starts provisioning directly via an intent with action
* {@link #ACTION_PROVISION_MANAGED_PROFILE} or
* {@link #ACTION_PROVISION_MANAGED_DEVICE} the package name of this
* component has to match the package name of the application that started provisioning.
*
* <p>This component is set as device owner and active admin when device owner provisioning is
* started by an intent with action {@link #ACTION_PROVISION_MANAGED_DEVICE} or by an NFC
* message containing an NFC record with MIME type
* {@link #MIME_TYPE_PROVISIONING_NFC}. For the NFC record, the component name must be
* flattened to a string, via {@link ComponentName#flattenToShortString()}.
*
* @see DeviceAdminReceiver
*/
public static final String EXTRA_PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME
= "android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME";
/**
* An {@link android.accounts.Account} extra holding the account to migrate during managed
* profile provisioning. If the account supplied is present in the primary user, it will be
* copied, along with its credentials to the managed profile and removed from the primary user.
*
* Use with {@link #ACTION_PROVISION_MANAGED_PROFILE}.
*/
public static final String EXTRA_PROVISIONING_ACCOUNT_TO_MIGRATE
= "android.app.extra.PROVISIONING_ACCOUNT_TO_MIGRATE";
/**
* Boolean extra to indicate that the migrated account should be kept. This is used in
* conjunction with {@link #EXTRA_PROVISIONING_ACCOUNT_TO_MIGRATE}. If it's set to {@code true},
* the account will not be removed from the primary user after it is migrated to the newly
* created user or profile.
*
* <p> Defaults to {@code false}
*
* <p> Use with {@link #ACTION_PROVISION_MANAGED_PROFILE} and
* {@link #EXTRA_PROVISIONING_ACCOUNT_TO_MIGRATE}
*/
public static final String EXTRA_PROVISIONING_KEEP_ACCOUNT_ON_MIGRATION
= "android.app.extra.PROVISIONING_KEEP_ACCOUNT_ON_MIGRATION";
/**
* @deprecated From {@link android.os.Build.VERSION_CODES#O}, never used while provisioning the
* device.
*/
@Deprecated
public static final String EXTRA_PROVISIONING_EMAIL_ADDRESS
= "android.app.extra.PROVISIONING_EMAIL_ADDRESS";
/**
* A integer extra indicating the predominant color to show during the provisioning.
* Refer to {@link android.graphics.Color} for how the color is represented.
*
* <p>Use with {@link #ACTION_PROVISION_MANAGED_PROFILE} or
* {@link #ACTION_PROVISION_MANAGED_DEVICE}.
*/
public static final String EXTRA_PROVISIONING_MAIN_COLOR =
"android.app.extra.PROVISIONING_MAIN_COLOR";
/**
* A Boolean extra that can be used by the mobile device management application to skip the
* disabling of system apps during provisioning when set to {@code true}.
*
* <p>Use in an NFC record with {@link #MIME_TYPE_PROVISIONING_NFC} or an intent with action
* {@link #ACTION_PROVISION_MANAGED_DEVICE} that starts device owner provisioning.
*/
public static final String EXTRA_PROVISIONING_LEAVE_ALL_SYSTEM_APPS_ENABLED =
"android.app.extra.PROVISIONING_LEAVE_ALL_SYSTEM_APPS_ENABLED";
/**
* A String extra holding the time zone {@link android.app.AlarmManager} that the device
* will be set to.
*
* <p>Use in an NFC record with {@link #MIME_TYPE_PROVISIONING_NFC} that starts device owner
* provisioning via an NFC bump.
*/
public static final String EXTRA_PROVISIONING_TIME_ZONE
= "android.app.extra.PROVISIONING_TIME_ZONE";
/**
* A Long extra holding the wall clock time (in milliseconds) to be set on the device's
* {@link android.app.AlarmManager}.
*
* <p>Use in an NFC record with {@link #MIME_TYPE_PROVISIONING_NFC} that starts device owner
* provisioning via an NFC bump.
*/
public static final String EXTRA_PROVISIONING_LOCAL_TIME
= "android.app.extra.PROVISIONING_LOCAL_TIME";
/**
* A String extra holding the {@link java.util.Locale} that the device will be set to.
* Format: xx_yy, where xx is the language code, and yy the country code.
*
* <p>Use in an NFC record with {@link #MIME_TYPE_PROVISIONING_NFC} that starts device owner
* provisioning via an NFC bump.
*/
public static final String EXTRA_PROVISIONING_LOCALE
= "android.app.extra.PROVISIONING_LOCALE";
/**
* A String extra holding the ssid of the wifi network that should be used during nfc device
* owner provisioning for downloading the mobile device management application.
*
* <p>Use in an NFC record with {@link #MIME_TYPE_PROVISIONING_NFC} that starts device owner
* provisioning via an NFC bump.
*/
public static final String EXTRA_PROVISIONING_WIFI_SSID
= "android.app.extra.PROVISIONING_WIFI_SSID";
/**
* A boolean extra indicating whether the wifi network in {@link #EXTRA_PROVISIONING_WIFI_SSID}
* is hidden or not.
*
* <p>Use in an NFC record with {@link #MIME_TYPE_PROVISIONING_NFC} that starts device owner
* provisioning via an NFC bump.
*/
public static final String EXTRA_PROVISIONING_WIFI_HIDDEN
= "android.app.extra.PROVISIONING_WIFI_HIDDEN";
/**
* A String extra indicating the security type of the wifi network in
* {@link #EXTRA_PROVISIONING_WIFI_SSID} and could be one of {@code NONE}, {@code WPA} or
* {@code WEP}.
*
* <p>Use in an NFC record with {@link #MIME_TYPE_PROVISIONING_NFC} that starts device owner
* provisioning via an NFC bump.
*/
public static final String EXTRA_PROVISIONING_WIFI_SECURITY_TYPE
= "android.app.extra.PROVISIONING_WIFI_SECURITY_TYPE";
/**
* A String extra holding the password of the wifi network in
* {@link #EXTRA_PROVISIONING_WIFI_SSID}.
*
* <p>Use in an NFC record with {@link #MIME_TYPE_PROVISIONING_NFC} that starts device owner
* provisioning via an NFC bump.
*/
public static final String EXTRA_PROVISIONING_WIFI_PASSWORD
= "android.app.extra.PROVISIONING_WIFI_PASSWORD";
/**
* A String extra holding the proxy host for the wifi network in
* {@link #EXTRA_PROVISIONING_WIFI_SSID}.
*
* <p>Use in an NFC record with {@link #MIME_TYPE_PROVISIONING_NFC} that starts device owner
* provisioning via an NFC bump.
*/
public static final String EXTRA_PROVISIONING_WIFI_PROXY_HOST
= "android.app.extra.PROVISIONING_WIFI_PROXY_HOST";
/**
* An int extra holding the proxy port for the wifi network in
* {@link #EXTRA_PROVISIONING_WIFI_SSID}.
*
* <p>Use in an NFC record with {@link #MIME_TYPE_PROVISIONING_NFC} that starts device owner
* provisioning via an NFC bump.
*/
public static final String EXTRA_PROVISIONING_WIFI_PROXY_PORT
= "android.app.extra.PROVISIONING_WIFI_PROXY_PORT";
/**
* A String extra holding the proxy bypass for the wifi network in
* {@link #EXTRA_PROVISIONING_WIFI_SSID}.
*
* <p>Use in an NFC record with {@link #MIME_TYPE_PROVISIONING_NFC} that starts device owner
* provisioning via an NFC bump.
*/
public static final String EXTRA_PROVISIONING_WIFI_PROXY_BYPASS
= "android.app.extra.PROVISIONING_WIFI_PROXY_BYPASS";
/**
* A String extra holding the proxy auto-config (PAC) URL for the wifi network in
* {@link #EXTRA_PROVISIONING_WIFI_SSID}.
*
* <p>Use in an NFC record with {@link #MIME_TYPE_PROVISIONING_NFC} that starts device owner
* provisioning via an NFC bump.
*/
public static final String EXTRA_PROVISIONING_WIFI_PAC_URL
= "android.app.extra.PROVISIONING_WIFI_PAC_URL";
/**
* A String extra holding a url that specifies the download location of the device admin
* package. When not provided it is assumed that the device admin package is already installed.
*
* <p>Use in an NFC record with {@link #MIME_TYPE_PROVISIONING_NFC} that starts device owner
* provisioning via an NFC bump.
*/
public static final String EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION
= "android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION";
/**
* A String extra holding the localized name of the organization under management.
*
* The name is displayed only during provisioning.
*
* <p>Use in an intent with action {@link #ACTION_PROVISION_MANAGED_DEVICE_FROM_TRUSTED_SOURCE}
*
* @hide
*/
@SystemApi
public static final String EXTRA_PROVISIONING_ORGANIZATION_NAME =
"android.app.extra.PROVISIONING_ORGANIZATION_NAME";
/**
* A String extra holding a url to the website of the device provider so the user can open it
* during provisioning. If the url is not HTTPS, an error will be shown.
*
* <p>Use in an intent with action {@link #ACTION_PROVISION_MANAGED_DEVICE_FROM_TRUSTED_SOURCE}
*
* @hide
*/
@SystemApi
public static final String EXTRA_PROVISIONING_SUPPORT_URL =
"android.app.extra.PROVISIONING_SUPPORT_URL";
/**
* A String extra holding the localized name of the device admin package. It should be the same
* as the app label of the package.
*
* <p>Use in an intent with action {@link #ACTION_PROVISION_MANAGED_DEVICE_FROM_TRUSTED_SOURCE}
*
* @hide
*/
@SystemApi
public static final String EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_LABEL =
"android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_LABEL";
/**
* A {@link Uri} extra pointing to the app icon of device admin package. This image will be
* shown during the provisioning.
* <h5>The following URI schemes are accepted:</h5>
* <ul>
* <li>content ({@link android.content.ContentResolver#SCHEME_CONTENT})</li>
* <li>android.resource ({@link android.content.ContentResolver#SCHEME_ANDROID_RESOURCE})</li>
* </ul>
*
* <p> It is the responsibility of the caller to provide an image with a reasonable
* pixel density for the device.
*
* <p> If a content: URI is passed, the intent should have the flag
* {@link Intent#FLAG_GRANT_READ_URI_PERMISSION} and the uri should be added to the
* {@link android.content.ClipData} of the intent too.
*
* <p>Use in an intent with action {@link #ACTION_PROVISION_MANAGED_DEVICE_FROM_TRUSTED_SOURCE}
*
* @hide
*/
@SystemApi
public static final String EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_ICON_URI =
"android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_ICON_URI";
/**
* An int extra holding a minimum required version code for the device admin package. If the
* device admin is already installed on the device, it will only be re-downloaded from
* {@link #EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION} if the version of the
* installed package is less than this version code.
*
* <p>Use in an NFC record with {@link #MIME_TYPE_PROVISIONING_NFC} that starts device owner
* provisioning via an NFC bump.
*/
public static final String EXTRA_PROVISIONING_DEVICE_ADMIN_MINIMUM_VERSION_CODE
= "android.app.extra.PROVISIONING_DEVICE_ADMIN_MINIMUM_VERSION_CODE";
/**
* A String extra holding a http cookie header which should be used in the http request to the
* url specified in {@link #EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION}.
*
* <p>Use in an NFC record with {@link #MIME_TYPE_PROVISIONING_NFC} that starts device owner
* provisioning via an NFC bump.
*/
public static final String EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_COOKIE_HEADER
= "android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_COOKIE_HEADER";
/**
* A String extra holding the URL-safe base64 encoded SHA-256 or SHA-1 hash (see notes below) of
* the file at download location specified in
* {@link #EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION}.
*
* <p>Either this extra or {@link #EXTRA_PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM} must be
* present. The provided checksum must match the checksum of the file at the download
* location. If the checksum doesn't match an error will be shown to the user and the user will
* be asked to factory reset the device.
*
* <p>Use in an NFC record with {@link #MIME_TYPE_PROVISIONING_NFC} that starts device owner
* provisioning via an NFC bump.
*
* <p><strong>Note:</strong> for devices running {@link android.os.Build.VERSION_CODES#LOLLIPOP}
* and {@link android.os.Build.VERSION_CODES#LOLLIPOP_MR1} only SHA-1 hash is supported.
* Starting from {@link android.os.Build.VERSION_CODES#M}, this parameter accepts SHA-256 in
* addition to SHA-1. Support for SHA-1 is likely to be removed in future OS releases.
*/
public static final String EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM
= "android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM";
/**
* A String extra holding the URL-safe base64 encoded SHA-256 checksum of any signature of the
* android package archive at the download location specified in {@link
* #EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION}.
*
* <p>The signatures of an android package archive can be obtained using
* {@link android.content.pm.PackageManager#getPackageArchiveInfo} with flag
* {@link android.content.pm.PackageManager#GET_SIGNATURES}.
*
* <p>Either this extra or {@link #EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM} must be
* present. The provided checksum must match the checksum of any signature of the file at
* the download location. If the checksum does not match an error will be shown to the user and
* the user will be asked to factory reset the device.
*
* <p>Use in an NFC record with {@link #MIME_TYPE_PROVISIONING_NFC} that starts device owner
* provisioning via an NFC bump.
*/
public static final String EXTRA_PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM
= "android.app.extra.PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM";
/**
* Broadcast Action: This broadcast is sent to indicate that provisioning of a managed profile
* has completed successfully.
*
* <p>The broadcast is limited to the primary profile, to the app specified in the provisioning
* intent with action {@link #ACTION_PROVISION_MANAGED_PROFILE}.
*
* <p>This intent will contain the following extras
* <ul>
* <li>{@link Intent#EXTRA_USER}, corresponds to the {@link UserHandle} of the managed
* profile.</li>
* <li>{@link #EXTRA_PROVISIONING_ACCOUNT_TO_MIGRATE}, corresponds to the account requested to
* be migrated at provisioning time, if any.</li>
* </ul>
*/
@SdkConstant(SdkConstantType.ACTIVITY_INTENT_ACTION)
public static final String ACTION_MANAGED_PROFILE_PROVISIONED
= "android.app.action.MANAGED_PROFILE_PROVISIONED";
/**
* Activity action: This activity action is sent to indicate that provisioning of a managed
* profile or managed device has completed successfully. It'll be sent at the same time as
* {@link DeviceAdminReceiver#ACTION_PROFILE_PROVISIONING_COMPLETE} broadcast but this will be
* delivered faster as it's an activity intent.
*
* <p>The intent is only sent to the new device or profile owner.
*
* @see #ACTION_PROVISION_MANAGED_PROFILE
* @see #ACTION_PROVISION_MANAGED_DEVICE
*/
@SdkConstant(SdkConstantType.ACTIVITY_INTENT_ACTION)
public static final String ACTION_PROVISIONING_SUCCESSFUL =
"android.app.action.PROVISIONING_SUCCESSFUL";
/**
* A boolean extra indicating whether device encryption can be skipped as part of device owner
* or managed profile provisioning.
*
* <p>Use in an NFC record with {@link #MIME_TYPE_PROVISIONING_NFC} or an intent with action
* {@link #ACTION_PROVISION_MANAGED_DEVICE} that starts device owner provisioning.
*
* <p>From {@link android.os.Build.VERSION_CODES#N} onwards, this is also supported for an
* intent with action {@link #ACTION_PROVISION_MANAGED_PROFILE}.
*/
public static final String EXTRA_PROVISIONING_SKIP_ENCRYPTION =
"android.app.extra.PROVISIONING_SKIP_ENCRYPTION";
/**
* A {@link Uri} extra pointing to a logo image. This image will be shown during the
* provisioning. If this extra is not passed, a default image will be shown.
* <h5>The following URI schemes are accepted:</h5>
* <ul>
* <li>content ({@link android.content.ContentResolver#SCHEME_CONTENT})</li>
* <li>android.resource ({@link android.content.ContentResolver#SCHEME_ANDROID_RESOURCE})</li>
* </ul>
*
* <p> It is the responsibility of the caller to provide an image with a reasonable
* pixel density for the device.
*
* <p> If a content: URI is passed, the intent should have the flag
* {@link Intent#FLAG_GRANT_READ_URI_PERMISSION} and the uri should be added to the
* {@link android.content.ClipData} of the intent too.
*
* <p>Use in an intent with action {@link #ACTION_PROVISION_MANAGED_PROFILE} or
* {@link #ACTION_PROVISION_MANAGED_DEVICE}
*/
public static final String EXTRA_PROVISIONING_LOGO_URI =
"android.app.extra.PROVISIONING_LOGO_URI";
/**
* A {@link Bundle}[] extra consisting of list of disclaimer headers and disclaimer contents.
* Each {@link Bundle} must have both {@link #EXTRA_PROVISIONING_DISCLAIMER_HEADER}
* as disclaimer header, and {@link #EXTRA_PROVISIONING_DISCLAIMER_CONTENT} as disclaimer
* content.
*
* <p> The extra typically contains one disclaimer from the company of mobile device
* management application (MDM), and one disclaimer from the organization.
*
* <p> Call {@link Bundle#putParcelableArray(String, Parcelable[])} to put the {@link Bundle}[]
*
* <p> Maximum 3 key-value pairs can be specified. The rest will be ignored.
*
* <p> Use in an intent with action {@link #ACTION_PROVISION_MANAGED_PROFILE} or
* {@link #ACTION_PROVISION_MANAGED_DEVICE}
*/
public static final String EXTRA_PROVISIONING_DISCLAIMERS =
"android.app.extra.PROVISIONING_DISCLAIMERS";
/**
* A String extra of localized disclaimer header.
*
* <p> The extra is typically the company name of mobile device management application (MDM)
* or the organization name.
*
* <p> Use in Bundle {@link #EXTRA_PROVISIONING_DISCLAIMERS}
*
* <p> System app, i.e. application with {@link ApplicationInfo#FLAG_SYSTEM}, can also insert a
* disclaimer by declaring an application-level meta-data in {@code AndroidManifest.xml}.
* Must use it with {@link #EXTRA_PROVISIONING_DISCLAIMER_CONTENT}. Here is the example:
*
* <pre>
* &lt;meta-data
* android:name="android.app.extra.PROVISIONING_DISCLAIMER_HEADER"
* android:resource="@string/disclaimer_header"
* /&gt;</pre>
*/
public static final String EXTRA_PROVISIONING_DISCLAIMER_HEADER =
"android.app.extra.PROVISIONING_DISCLAIMER_HEADER";
/**
* A {@link Uri} extra pointing to disclaimer content.
*
* <h5>The following URI schemes are accepted:</h5>
* <ul>
* <li>content ({@link android.content.ContentResolver#SCHEME_CONTENT})</li>
* <li>android.resource ({@link android.content.ContentResolver#SCHEME_ANDROID_RESOURCE})</li>
* </ul>
*
* <p> Styled text is supported in the disclaimer content. The content is parsed by
* {@link android.text.Html#fromHtml(String)} and displayed in a
* {@link android.widget.TextView}.
*
* <p> If a <code>content:</code> URI is passed, URI is passed, the intent should have the flag
* {@link Intent#FLAG_GRANT_READ_URI_PERMISSION} and the uri should be added to the
* {@link android.content.ClipData} of the intent too.
*
* <p> Use in Bundle {@link #EXTRA_PROVISIONING_DISCLAIMERS}
*
* <p> System app, i.e. application with {@link ApplicationInfo#FLAG_SYSTEM}, can also insert a
* disclaimer by declaring an application-level meta-data in {@code AndroidManifest.xml}.
* Must use it with {@link #EXTRA_PROVISIONING_DISCLAIMER_HEADER}. Here is the example:
*
* <pre>
* &lt;meta-data
* android:name="android.app.extra.PROVISIONING_DISCLAIMER_CONTENT"
* android:resource="@string/disclaimer_content"
* /&gt;</pre>
*/
public static final String EXTRA_PROVISIONING_DISCLAIMER_CONTENT =
"android.app.extra.PROVISIONING_DISCLAIMER_CONTENT";
/**
* A boolean extra indicating if user setup should be skipped, for when provisioning is started
* during setup-wizard.
*
* <p>If unspecified, defaults to {@code true} to match the behavior in
* {@link android.os.Build.VERSION_CODES#M} and earlier.
*
* <p>Use in an intent with action {@link #ACTION_PROVISION_MANAGED_DEVICE} or
* {@link #ACTION_PROVISION_MANAGED_USER}.
*
* @hide
*/
public static final String EXTRA_PROVISIONING_SKIP_USER_SETUP =
"android.app.extra.PROVISIONING_SKIP_USER_SETUP";
/**
* A boolean extra indicating if the user consent steps from the provisioning flow should be
* skipped. If unspecified, defaults to {@code false}.
*
* It can only be used by an existing device owner trying to create a managed profile via
* {@link #ACTION_PROVISION_MANAGED_PROFILE}. Otherwise it is ignored.
*/
public static final String EXTRA_PROVISIONING_SKIP_USER_CONSENT =
"android.app.extra.PROVISIONING_SKIP_USER_CONSENT";
/**
* A boolean extra indicating if mobile data should be used during NFC device owner provisioning
* for downloading the mobile device management application. If {@link
* #EXTRA_PROVISIONING_WIFI_SSID} is also specified, wifi network will be used instead.
*
* <p>Use in an NFC record with {@link #MIME_TYPE_PROVISIONING_NFC} that starts device owner
* provisioning via an NFC bump.
*
* @hide
*/
public static final String EXTRA_PROVISIONING_USE_MOBILE_DATA =
"android.app.extra.PROVISIONING_USE_MOBILE_DATA";
/**
* This MIME type is used for starting the device owner provisioning.
*
* <p>During device owner provisioning a device admin app is set as the owner of the device.
* A device owner has full control over the device. The device owner can not be modified by the
* user and the only way of resetting the device is if the device owner app calls a factory
* reset.
*
* <p> A typical use case would be a device that is owned by a company, but used by either an
* employee or client.
*
* <p> The NFC message must be sent to an unprovisioned device.
*
* <p>The NFC record must contain a serialized {@link java.util.Properties} object which
* contains the following properties:
* <ul>
* <li>{@link #EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME}</li>
* <li>{@link #EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_COOKIE_HEADER}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_LOCAL_TIME} (convert to String), optional</li>
* <li>{@link #EXTRA_PROVISIONING_TIME_ZONE}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_LOCALE}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_WIFI_SSID}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_WIFI_HIDDEN} (convert to String), optional</li>
* <li>{@link #EXTRA_PROVISIONING_WIFI_SECURITY_TYPE}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_WIFI_PASSWORD}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_WIFI_PROXY_HOST}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_WIFI_PROXY_PORT} (convert to String), optional</li>
* <li>{@link #EXTRA_PROVISIONING_WIFI_PROXY_BYPASS}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_WIFI_PAC_URL}, optional</li>
* <li>{@link #EXTRA_PROVISIONING_ADMIN_EXTRAS_BUNDLE}, optional, supported from
* {@link android.os.Build.VERSION_CODES#M} </li></ul>
*
* <p>
* As of {@link android.os.Build.VERSION_CODES#M}, the properties should contain
* {@link #EXTRA_PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME} instead of
* {@link #EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME}, (although specifying only
* {@link #EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME} is still supported).
*/
public static final String MIME_TYPE_PROVISIONING_NFC
= "application/com.android.managedprovisioning";
/**
* Activity action: ask the user to add a new device administrator to the system.
* The desired policy is the ComponentName of the policy in the
* {@link #EXTRA_DEVICE_ADMIN} extra field. This will invoke a UI to
* bring the user through adding the device administrator to the system (or
* allowing them to reject it).
*
* <p>You can optionally include the {@link #EXTRA_ADD_EXPLANATION}
* field to provide the user with additional explanation (in addition
* to your component's description) about what is being added.
*
* <p>If your administrator is already active, this will ordinarily return immediately (without
* user intervention). However, if your administrator has been updated and is requesting
* additional uses-policy flags, the user will be presented with the new list. New policies
* will not be available to the updated administrator until the user has accepted the new list.
*/
@SdkConstant(SdkConstantType.ACTIVITY_INTENT_ACTION)
public static final String ACTION_ADD_DEVICE_ADMIN
= "android.app.action.ADD_DEVICE_ADMIN";
/**
* @hide
* Activity action: ask the user to add a new device administrator as the profile owner
* for this user. Only system apps can launch this intent.
*
* <p>The ComponentName of the profile owner admin is passed in the {@link #EXTRA_DEVICE_ADMIN}
* extra field. This will invoke a UI to bring the user through adding the profile owner admin
* to remotely control restrictions on the user.
*
* <p>The intent must be invoked via {@link Activity#startActivityForResult} to receive the
* result of whether or not the user approved the action. If approved, the result will
* be {@link Activity#RESULT_OK} and the component will be set as an active admin as well
* as a profile owner.
*
* <p>You can optionally include the {@link #EXTRA_ADD_EXPLANATION}
* field to provide the user with additional explanation (in addition
* to your component's description) about what is being added.
*
* <p>If there is already a profile owner active or the caller is not a system app, the
* operation will return a failure result.
*/
@SystemApi
public static final String ACTION_SET_PROFILE_OWNER
= "android.app.action.SET_PROFILE_OWNER";
/**
* @hide
* Name of the profile owner admin that controls the user.
*/
@SystemApi
public static final String EXTRA_PROFILE_OWNER_NAME
= "android.app.extra.PROFILE_OWNER_NAME";
/**
* Broadcast action: send when any policy admin changes a policy.
* This is generally used to find out when a new policy is in effect.
*
* @hide
*/
@UnsupportedAppUsage
public static final String ACTION_DEVICE_POLICY_MANAGER_STATE_CHANGED
= "android.app.action.DEVICE_POLICY_MANAGER_STATE_CHANGED";
/**
* Broadcast action: sent when the device owner is set, changed or cleared.
*
* This broadcast is sent only to the primary user.
* @see #ACTION_PROVISION_MANAGED_DEVICE
* @see DevicePolicyManager#transferOwnership(ComponentName, ComponentName, PersistableBundle)
*/
@SdkConstant(SdkConstantType.BROADCAST_INTENT_ACTION)
public static final String ACTION_DEVICE_OWNER_CHANGED
= "android.app.action.DEVICE_OWNER_CHANGED";
/**
* The ComponentName of the administrator component.
*
* @see #ACTION_ADD_DEVICE_ADMIN
*/
public static final String EXTRA_DEVICE_ADMIN = "android.app.extra.DEVICE_ADMIN";
/**
* An optional CharSequence providing additional explanation for why the
* admin is being added.
*
* @see #ACTION_ADD_DEVICE_ADMIN
*/
public static final String EXTRA_ADD_EXPLANATION = "android.app.extra.ADD_EXPLANATION";
/**
* Constant to indicate the feature of disabling the camera. Used as argument to
* {@link #createAdminSupportIntent(String)}.
* @see #setCameraDisabled(ComponentName, boolean)
*/
public static final String POLICY_DISABLE_CAMERA = "policy_disable_camera";
/**
* Constant to indicate the feature of disabling screen captures. Used as argument to
* {@link #createAdminSupportIntent(String)}.
* @see #setScreenCaptureDisabled(ComponentName, boolean)
*/
public static final String POLICY_DISABLE_SCREEN_CAPTURE = "policy_disable_screen_capture";
/**
* Constant to indicate the feature of mandatory backups. Used as argument to
* {@link #createAdminSupportIntent(String)}.
* @see #setMandatoryBackupTransport(ComponentName, ComponentName)
* @hide
*/
public static final String POLICY_MANDATORY_BACKUPS = "policy_mandatory_backups";
/**
* Constant to indicate the feature of suspending app. Use it as the value of
* {@link #EXTRA_RESTRICTION}.
* @hide
*/
public static final String POLICY_SUSPEND_PACKAGES = "policy_suspend_packages";
/**
* A String indicating a specific restricted feature. Can be a user restriction from the
* {@link UserManager}, e.g. {@link UserManager#DISALLOW_ADJUST_VOLUME}, or one of the values
* {@link #POLICY_DISABLE_CAMERA}, {@link #POLICY_DISABLE_SCREEN_CAPTURE} or
* {@link #POLICY_MANDATORY_BACKUPS}.
* @see #createAdminSupportIntent(String)
* @hide
*/
@TestApi
public static final String EXTRA_RESTRICTION = "android.app.extra.RESTRICTION";
/**
* Activity action: have the user enter a new password. This activity should
* be launched after using {@link #setPasswordQuality(ComponentName, int)},
* or {@link #setPasswordMinimumLength(ComponentName, int)} to have the user
* enter a new password that meets the current requirements. You can use
* {@link #isActivePasswordSufficient()} to determine whether you need to
* have the user select a new password in order to meet the current
* constraints. Upon being resumed from this activity, you can check the new
* password characteristics to see if they are sufficient.
*
* If the intent is launched from within a managed profile with a profile
* owner built against {@link android.os.Build.VERSION_CODES#M} or before,
* this will trigger entering a new password for the parent of the profile.
* For all other cases it will trigger entering a new password for the user
* or profile it is launched from.
*
* @see #ACTION_SET_NEW_PARENT_PROFILE_PASSWORD
*/
@SdkConstant(SdkConstantType.ACTIVITY_INTENT_ACTION)
public static final String ACTION_SET_NEW_PASSWORD
= "android.app.action.SET_NEW_PASSWORD";
/**
* Activity action: have the user enter a new password for the parent profile.
* If the intent is launched from within a managed profile, this will trigger
* entering a new password for the parent of the profile. In all other cases
* the behaviour is identical to {@link #ACTION_SET_NEW_PASSWORD}.
*/
@SdkConstant(SdkConstantType.ACTIVITY_INTENT_ACTION)
public static final String ACTION_SET_NEW_PARENT_PROFILE_PASSWORD
= "android.app.action.SET_NEW_PARENT_PROFILE_PASSWORD";
/**
* Broadcast action: Tell the status bar to open the device monitoring dialog, e.g. when
* Network logging was enabled and the user tapped the notification.
* <p class="note">This is a protected intent that can only be sent by the system.</p>
* @hide
*/
public static final String ACTION_SHOW_DEVICE_MONITORING_DIALOG
= "android.app.action.SHOW_DEVICE_MONITORING_DIALOG";
/**
* Broadcast Action: Sent after application delegation scopes are changed. The new delegation
* scopes will be sent in an {@code ArrayList<String>} extra identified by the
* {@link #EXTRA_DELEGATION_SCOPES} key.
*
* <p class=”note”> Note: This is a protected intent that can only be sent by the system.</p>
*/
@SdkConstant(SdkConstantType.BROADCAST_INTENT_ACTION)
public static final String ACTION_APPLICATION_DELEGATION_SCOPES_CHANGED =
"android.app.action.APPLICATION_DELEGATION_SCOPES_CHANGED";
/**
* An {@code ArrayList<String>} corresponding to the delegation scopes given to an app in the
* {@link #ACTION_APPLICATION_DELEGATION_SCOPES_CHANGED} broadcast.
*/
public static final String EXTRA_DELEGATION_SCOPES = "android.app.extra.DELEGATION_SCOPES";
/**
* Flag used by {@link #addCrossProfileIntentFilter} to allow activities in
* the parent profile to access intents sent from the managed profile.
* That is, when an app in the managed profile calls
* {@link Activity#startActivity(Intent)}, the intent can be resolved by a
* matching activity in the parent profile.
*/
public static final int FLAG_PARENT_CAN_ACCESS_MANAGED = 0x0001;
/**
* Flag used by {@link #addCrossProfileIntentFilter} to allow activities in
* the managed profile to access intents sent from the parent profile.
* That is, when an app in the parent profile calls
* {@link Activity#startActivity(Intent)}, the intent can be resolved by a
* matching activity in the managed profile.
*/
public static final int FLAG_MANAGED_CAN_ACCESS_PARENT = 0x0002;
/**
* Broadcast action: notify that a new local system update policy has been set by the device
* owner. The new policy can be retrieved by {@link #getSystemUpdatePolicy()}.
*/
@SdkConstant(SdkConstantType.BROADCAST_INTENT_ACTION)
public static final String ACTION_SYSTEM_UPDATE_POLICY_CHANGED
= "android.app.action.SYSTEM_UPDATE_POLICY_CHANGED";
/**
* Broadcast action to notify ManagedProvisioning that
* {@link UserManager#DISALLOW_SHARE_INTO_MANAGED_PROFILE} restriction has changed.
* @hide
*/
@SdkConstant(SdkConstantType.BROADCAST_INTENT_ACTION)
public static final String ACTION_DATA_SHARING_RESTRICTION_CHANGED =
"android.app.action.DATA_SHARING_RESTRICTION_CHANGED";
/**
* Broadcast action from ManagedProvisioning to notify that the latest change to
* {@link UserManager#DISALLOW_SHARE_INTO_MANAGED_PROFILE} restriction has been successfully
* applied (cross profile intent filters updated). Only usesd for CTS tests.
* @hide
*/
@TestApi
@SdkConstant(SdkConstantType.BROADCAST_INTENT_ACTION)
public static final String ACTION_DATA_SHARING_RESTRICTION_APPLIED =
"android.app.action.DATA_SHARING_RESTRICTION_APPLIED";
/**
* Permission policy to prompt user for new permission requests for runtime permissions.
* Already granted or denied permissions are not affected by this.
*/
public static final int PERMISSION_POLICY_PROMPT = 0;
/**
* Permission policy to always grant new permission requests for runtime permissions.
* Already granted or denied permissions are not affected by this.
*/
public static final int PERMISSION_POLICY_AUTO_GRANT = 1;
/**
* Permission policy to always deny new permission requests for runtime permissions.
* Already granted or denied permissions are not affected by this.
*/
public static final int PERMISSION_POLICY_AUTO_DENY = 2;
/**
* Runtime permission state: The user can manage the permission
* through the UI.
*/
public static final int PERMISSION_GRANT_STATE_DEFAULT = 0;
/**
* Runtime permission state: The permission is granted to the app
* and the user cannot manage the permission through the UI.
*/
public static final int PERMISSION_GRANT_STATE_GRANTED = 1;
/**
* Runtime permission state: The permission is denied to the app
* and the user cannot manage the permission through the UI.
*/
public static final int PERMISSION_GRANT_STATE_DENIED = 2;
/**
* Delegation of certificate installation and management. This scope grants access to the
* {@link #getInstalledCaCerts}, {@link #hasCaCertInstalled}, {@link #installCaCert},
* {@link #uninstallCaCert}, {@link #uninstallAllUserCaCerts} and {@link #installKeyPair} APIs.
*/
public static final String DELEGATION_CERT_INSTALL = "delegation-cert-install";
/**
* Delegation of application restrictions management. This scope grants access to the
* {@link #setApplicationRestrictions} and {@link #getApplicationRestrictions} APIs.
*/
public static final String DELEGATION_APP_RESTRICTIONS = "delegation-app-restrictions";
/**
* Delegation of application uninstall block. This scope grants access to the
* {@link #setUninstallBlocked} API.
*/
public static final String DELEGATION_BLOCK_UNINSTALL = "delegation-block-uninstall";
/**
* Delegation of permission policy and permission grant state. This scope grants access to the
* {@link #setPermissionPolicy}, {@link #getPermissionGrantState},
* and {@link #setPermissionGrantState} APIs.
*/
public static final String DELEGATION_PERMISSION_GRANT = "delegation-permission-grant";
/**
* Delegation of package access state. This scope grants access to the
* {@link #isApplicationHidden}, {@link #setApplicationHidden}, {@link #isPackageSuspended}, and
* {@link #setPackagesSuspended} APIs.
*/
public static final String DELEGATION_PACKAGE_ACCESS = "delegation-package-access";
/**
* Delegation for enabling system apps. This scope grants access to the {@link #enableSystemApp}
* API.
*/
public static final String DELEGATION_ENABLE_SYSTEM_APP = "delegation-enable-system-app";
/**
* Delegation for installing existing packages. This scope grants access to the
* {@link #installExistingPackage} API.
*/
public static final String DELEGATION_INSTALL_EXISTING_PACKAGE =
"delegation-install-existing-package";
/**
* Delegation of management of uninstalled packages. This scope grants access to the
* {@code #setKeepUninstalledPackages} and {@code #getKeepUninstalledPackages} APIs.
*/
public static final String DELEGATION_KEEP_UNINSTALLED_PACKAGES =
"delegation-keep-uninstalled-packages";
/**
* No management for current user in-effect. This is the default.
* @hide
*/
@SystemApi
public static final int STATE_USER_UNMANAGED = 0;
/**
* Management partially setup, user setup needs to be completed.
* @hide
*/
@SystemApi
public static final int STATE_USER_SETUP_INCOMPLETE = 1;
/**
* Management partially setup, user setup completed.
* @hide
*/
@SystemApi
public static final int STATE_USER_SETUP_COMPLETE = 2;
/**
* Management setup and active on current user.
* @hide
*/
@SystemApi
public static final int STATE_USER_SETUP_FINALIZED = 3;
/**
* Management partially setup on a managed profile.
* @hide
*/
@SystemApi
public static final int STATE_USER_PROFILE_COMPLETE = 4;
/**
* @hide
*/
@IntDef(prefix = { "STATE_USER_" }, value = {
STATE_USER_UNMANAGED,
STATE_USER_SETUP_INCOMPLETE,
STATE_USER_SETUP_COMPLETE,
STATE_USER_SETUP_FINALIZED,
STATE_USER_PROFILE_COMPLETE
})
@Retention(RetentionPolicy.SOURCE)
public @interface UserProvisioningState {}
/**
* Result code for {@link #checkProvisioningPreCondition}.
*
* <p>Returned for {@link #ACTION_PROVISION_MANAGED_DEVICE},
* {@link #ACTION_PROVISION_MANAGED_PROFILE}, {@link #ACTION_PROVISION_MANAGED_USER} and
* {@link #ACTION_PROVISION_MANAGED_SHAREABLE_DEVICE} when provisioning is allowed.
*
* @hide
*/
public static final int CODE_OK = 0;
/**
* Result code for {@link #checkProvisioningPreCondition}.
*
* <p>Returned for {@link #ACTION_PROVISION_MANAGED_DEVICE} and
* {@link #ACTION_PROVISION_MANAGED_SHAREABLE_DEVICE} when the device already has a device
* owner.
*
* @hide
*/
public static final int CODE_HAS_DEVICE_OWNER = 1;
/**
* Result code for {@link #checkProvisioningPreCondition}.
*
* <p>Returned for {@link #ACTION_PROVISION_MANAGED_DEVICE},
* {@link #ACTION_PROVISION_MANAGED_SHAREABLE_DEVICE} when the user has a profile owner and for
* {@link #ACTION_PROVISION_MANAGED_PROFILE} when the profile owner is already set.
*
* @hide
*/
public static final int CODE_USER_HAS_PROFILE_OWNER = 2;
/**
* Result code for {@link #checkProvisioningPreCondition}.
*
* <p>Returned for {@link #ACTION_PROVISION_MANAGED_DEVICE} and
* {@link #ACTION_PROVISION_MANAGED_SHAREABLE_DEVICE} when the user isn't running.
*
* @hide
*/
public static final int CODE_USER_NOT_RUNNING = 3;
/**
* Result code for {@link #checkProvisioningPreCondition}.
*
* <p>Returned for {@link #ACTION_PROVISION_MANAGED_DEVICE},
* {@link #ACTION_PROVISION_MANAGED_SHAREABLE_DEVICE} if the device has already been setup and
* for {@link #ACTION_PROVISION_MANAGED_USER} if the user has already been setup.
*
* @hide
*/
public static final int CODE_USER_SETUP_COMPLETED = 4;
/**
* Code used to indicate that the device also has a user other than the system user.
*
* @hide
*/
public static final int CODE_NONSYSTEM_USER_EXISTS = 5;
/**
* Code used to indicate that device has an account that prevents provisioning.
*
* @hide
*/
public static final int CODE_ACCOUNTS_NOT_EMPTY = 6;
/**
* Result code for {@link #checkProvisioningPreCondition}.
*
* <p>Returned for {@link #ACTION_PROVISION_MANAGED_DEVICE} and
* {@link #ACTION_PROVISION_MANAGED_SHAREABLE_DEVICE} if the user is not a system user.
*
* @hide
*/
public static final int CODE_NOT_SYSTEM_USER = 7;
/**
* Result code for {@link #checkProvisioningPreCondition}.
*
* <p>Returned for {@link #ACTION_PROVISION_MANAGED_DEVICE},
* {@link #ACTION_PROVISION_MANAGED_SHAREABLE_DEVICE} and {@link #ACTION_PROVISION_MANAGED_USER}
* when the device is a watch and is already paired.
*
* @hide
*/
public static final int CODE_HAS_PAIRED = 8;
/**
* Result code for {@link #checkProvisioningPreCondition}.
*
* <p>Returned for {@link #ACTION_PROVISION_MANAGED_PROFILE} and
* {@link #ACTION_PROVISION_MANAGED_USER} on devices which do not support managed users.
*
* @see {@link PackageManager#FEATURE_MANAGED_USERS}
* @hide
*/
public static final int CODE_MANAGED_USERS_NOT_SUPPORTED = 9;
/**
* Result code for {@link #checkProvisioningPreCondition}.
*
* <p>Returned for {@link #ACTION_PROVISION_MANAGED_USER} if the user is a system user.
*
* @hide
*/
public static final int CODE_SYSTEM_USER = 10;
/**
* Result code for {@link #checkProvisioningPreCondition}.
*
* <p>Returned for {@link #ACTION_PROVISION_MANAGED_PROFILE} when the user cannot have more
* managed profiles.
*
* @hide
*/
public static final int CODE_CANNOT_ADD_MANAGED_PROFILE = 11;
/**
* Result code for {@link #checkProvisioningPreCondition}.
*
* <p>Returned for {@link #ACTION_PROVISION_MANAGED_USER} and
* {@link #ACTION_PROVISION_MANAGED_SHAREABLE_DEVICE} on devices not running with split system
* user.
*
* @hide
*/
public static final int CODE_NOT_SYSTEM_USER_SPLIT = 12;
/**
* Result code for {@link #checkProvisioningPreCondition}.
*
* <p>Returned for {@link #ACTION_PROVISION_MANAGED_DEVICE},
* {@link #ACTION_PROVISION_MANAGED_PROFILE}, {@link #ACTION_PROVISION_MANAGED_USER} and
* {@link #ACTION_PROVISION_MANAGED_SHAREABLE_DEVICE} on devices which do no support device
* admins.
*
* @hide
*/
public static final int CODE_DEVICE_ADMIN_NOT_SUPPORTED = 13;
/**
* Result code for {@link #checkProvisioningPreCondition}.
*
* <p>Returned for {@link #ACTION_PROVISION_MANAGED_PROFILE} when the device the user is a
* system user on a split system user device.
*
* @hide
*/
public static final int CODE_SPLIT_SYSTEM_USER_DEVICE_SYSTEM_USER = 14;
/**
* Result code for {@link #checkProvisioningPreCondition}.
*
* <p>Returned for {@link #ACTION_PROVISION_MANAGED_PROFILE} when adding a managed profile is
* disallowed by {@link UserManager#DISALLOW_ADD_MANAGED_PROFILE}.
*
* @hide
*/
public static final int CODE_ADD_MANAGED_PROFILE_DISALLOWED = 15;
/**
* Result codes for {@link #checkProvisioningPreCondition} indicating all the provisioning pre
* conditions.
*
* @hide
*/
@Retention(RetentionPolicy.SOURCE)
@IntDef(prefix = { "CODE_" }, value = {
CODE_OK, CODE_HAS_DEVICE_OWNER, CODE_USER_HAS_PROFILE_OWNER, CODE_USER_NOT_RUNNING,
CODE_USER_SETUP_COMPLETED, CODE_NOT_SYSTEM_USER, CODE_HAS_PAIRED,
CODE_MANAGED_USERS_NOT_SUPPORTED, CODE_SYSTEM_USER, CODE_CANNOT_ADD_MANAGED_PROFILE,
CODE_NOT_SYSTEM_USER_SPLIT, CODE_DEVICE_ADMIN_NOT_SUPPORTED,
CODE_SPLIT_SYSTEM_USER_DEVICE_SYSTEM_USER, CODE_ADD_MANAGED_PROFILE_DISALLOWED
})
public @interface ProvisioningPreCondition {}
/**
* Disable all configurable SystemUI features during LockTask mode. This includes,
* <ul>
* <li>system info area in the status bar (connectivity icons, clock, etc.)
* <li>notifications (including alerts, icons, and the notification shade)
* <li>Home button
* <li>Recents button and UI
* <li>global actions menu (i.e. power button menu)
* <li>keyguard
* </ul>
*
* @see #setLockTaskFeatures(ComponentName, int)
*/
public static final int LOCK_TASK_FEATURE_NONE = 0;
/**
* Enable the system info area in the status bar during LockTask mode. The system info area
* usually occupies the right side of the status bar (although this can differ across OEMs). It
* includes all system information indicators, such as date and time, connectivity, battery,
* vibration mode, etc.
*
* @see #setLockTaskFeatures(ComponentName, int)
*/
public static final int LOCK_TASK_FEATURE_SYSTEM_INFO = 1;
/**
* Enable notifications during LockTask mode. This includes notification icons on the status
* bar, heads-up notifications, and the expandable notification shade. Note that the Quick
* Settings panel remains disabled. This feature flag can only be used in combination with
* {@link #LOCK_TASK_FEATURE_HOME}. {@link #setLockTaskFeatures(ComponentName, int)}
* throws an {@link IllegalArgumentException} if this feature flag is defined without
* {@link #LOCK_TASK_FEATURE_HOME}.
*
* @see #setLockTaskFeatures(ComponentName, int)
*/
public static final int LOCK_TASK_FEATURE_NOTIFICATIONS = 1 << 1;
/**
* Enable the Home button during LockTask mode. Note that if a custom launcher is used, it has
* to be registered as the default launcher with
* {@link #addPersistentPreferredActivity(ComponentName, IntentFilter, ComponentName)}, and its
* package needs to be whitelisted for LockTask with
* {@link #setLockTaskPackages(ComponentName, String[])}.
*
* @see #setLockTaskFeatures(ComponentName, int)
*/
public static final int LOCK_TASK_FEATURE_HOME = 1 << 2;
/**
* Enable the Overview button and the Overview screen during LockTask mode. This feature flag
* can only be used in combination with {@link #LOCK_TASK_FEATURE_HOME}, and
* {@link #setLockTaskFeatures(ComponentName, int)} will throw an
* {@link IllegalArgumentException} if this feature flag is defined without
* {@link #LOCK_TASK_FEATURE_HOME}.
*
* @see #setLockTaskFeatures(ComponentName, int)
*/
public static final int LOCK_TASK_FEATURE_OVERVIEW = 1 << 3;
/**
* Enable the global actions dialog during LockTask mode. This is the dialog that shows up when
* the user long-presses the power button, for example. Note that the user may not be able to
* power off the device if this flag is not set.
*
* <p>This flag is enabled by default until {@link #setLockTaskFeatures(ComponentName, int)} is
* called for the first time.
*
* @see #setLockTaskFeatures(ComponentName, int)
*/
public static final int LOCK_TASK_FEATURE_GLOBAL_ACTIONS = 1 << 4;
/**
* Enable the keyguard during LockTask mode. Note that if the keyguard is already disabled with
* {@link #setKeyguardDisabled(ComponentName, boolean)}, setting this flag will have no effect.
* If this flag is not set, the keyguard will not be shown even if the user has a lock screen
* credential.
*
* @see #setLockTaskFeatures(ComponentName, int)
*/
public static final int LOCK_TASK_FEATURE_KEYGUARD = 1 << 5;
/**
* Flags supplied to {@link #setLockTaskFeatures(ComponentName, int)}.
*
* @hide
*/
@Retention(RetentionPolicy.SOURCE)
@IntDef(flag = true, prefix = { "LOCK_TASK_FEATURE_" }, value = {
LOCK_TASK_FEATURE_NONE,
LOCK_TASK_FEATURE_SYSTEM_INFO,
LOCK_TASK_FEATURE_NOTIFICATIONS,
LOCK_TASK_FEATURE_HOME,
LOCK_TASK_FEATURE_OVERVIEW,
LOCK_TASK_FEATURE_GLOBAL_ACTIONS,
LOCK_TASK_FEATURE_KEYGUARD
})
public @interface LockTaskFeature {}
/**
* Service action: Action for a service that device owner and profile owner can optionally
* own. If a device owner or a profile owner has such a service, the system tries to keep
* a bound connection to it, in order to keep their process always running.
* The service must be protected with the {@link android.Manifest.permission#BIND_DEVICE_ADMIN}
* permission.
*/
@SdkConstant(SdkConstantType.SERVICE_ACTION)
public static final String ACTION_DEVICE_ADMIN_SERVICE
= "android.app.action.DEVICE_ADMIN_SERVICE";
/** @hide */
@Retention(RetentionPolicy.SOURCE)
@IntDef(flag = true, prefix = {"ID_TYPE_"}, value = {
ID_TYPE_BASE_INFO,
ID_TYPE_SERIAL,
ID_TYPE_IMEI,
ID_TYPE_MEID
})
public @interface AttestationIdType {}
/**
* Specifies that the device should attest its manufacturer details. For use with
* {@link #generateKeyPair}.
*
* @see #generateKeyPair
*/
public static final int ID_TYPE_BASE_INFO = 1;
/**
* Specifies that the device should attest its serial number. For use with
* {@link #generateKeyPair}.
*
* @see #generateKeyPair
*/
public static final int ID_TYPE_SERIAL = 2;
/**
* Specifies that the device should attest its IMEI. For use with {@link #generateKeyPair}.
*
* @see #generateKeyPair
*/
public static final int ID_TYPE_IMEI = 4;
/**
* Specifies that the device should attest its MEID. For use with {@link #generateKeyPair}.
*
* @see #generateKeyPair
*/
public static final int ID_TYPE_MEID = 8;
/**
* Specifies that the calling app should be granted access to the installed credentials
* immediately. Otherwise, access to the credentials will be gated by user approval.
* For use with {@link #installKeyPair(ComponentName, PrivateKey, Certificate[], String, int)}
*
* @see #installKeyPair(ComponentName, PrivateKey, Certificate[], String, int)
*/
public static final int INSTALLKEY_REQUEST_CREDENTIALS_ACCESS = 1;
/**
* Specifies that a user can select the key via the Certificate Selection prompt.
* If this flag is not set when calling {@link #installKeyPair}, the key can only be granted
* access by implementing {@link android.app.admin.DeviceAdminReceiver#onChoosePrivateKeyAlias}.
* For use with {@link #installKeyPair(ComponentName, PrivateKey, Certificate[], String, int)}
*
* @see #installKeyPair(ComponentName, PrivateKey, Certificate[], String, int)
*/
public static final int INSTALLKEY_SET_USER_SELECTABLE = 2;
/**
* Broadcast action: sent when the profile owner is set, changed or cleared.
*
* This broadcast is sent only to the user managed by the new profile owner.
* @see DevicePolicyManager#transferOwnership(ComponentName, ComponentName, PersistableBundle)
*/
@SdkConstant(SdkConstantType.BROADCAST_INTENT_ACTION)
public static final String ACTION_PROFILE_OWNER_CHANGED =
"android.app.action.PROFILE_OWNER_CHANGED";
/**
* Return true if the given administrator component is currently active (enabled) in the system.
*
* @param admin The administrator component to check for.
* @return {@code true} if {@code admin} is currently enabled in the system, {@code false}
* otherwise
*/
public boolean isAdminActive(@NonNull ComponentName admin) {
throwIfParentInstance("isAdminActive");
return isAdminActiveAsUser(admin, myUserId());
}
/**
* @see #isAdminActive(ComponentName)
* @hide
*/
public boolean isAdminActiveAsUser(@NonNull ComponentName admin, int userId) {
if (mService != null) {
try {
return mService.isAdminActive(admin, userId);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return false;
}
/**
* Return true if the given administrator component is currently being removed
* for the user.
* @hide
*/
public boolean isRemovingAdmin(@NonNull ComponentName admin, int userId) {
if (mService != null) {
try {
return mService.isRemovingAdmin(admin, userId);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return false;
}
/**
* Return a list of all currently active device administrators' component
* names. If there are no administrators {@code null} may be
* returned.
*/
public @Nullable List<ComponentName> getActiveAdmins() {
throwIfParentInstance("getActiveAdmins");
return getActiveAdminsAsUser(myUserId());
}
/**
* @see #getActiveAdmins()
* @hide
*/
@UnsupportedAppUsage
public @Nullable List<ComponentName> getActiveAdminsAsUser(int userId) {
if (mService != null) {
try {
return mService.getActiveAdmins(userId);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return null;
}
/**
* Used by package administration code to determine if a package can be stopped
* or uninstalled.
* @hide
*/
@SystemApi
@RequiresPermission(android.Manifest.permission.INTERACT_ACROSS_USERS_FULL)
public boolean packageHasActiveAdmins(String packageName) {
return packageHasActiveAdmins(packageName, myUserId());
}
/**
* Used by package administration code to determine if a package can be stopped
* or uninstalled.
* @hide
*/
@UnsupportedAppUsage
public boolean packageHasActiveAdmins(String packageName, int userId) {
if (mService != null) {
try {
return mService.packageHasActiveAdmins(packageName, userId);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return false;
}
/**
* Remove a current administration component. This can only be called
* by the application that owns the administration component; if you
* try to remove someone else's component, a security exception will be
* thrown.
*
* <p>Note that the operation is not synchronous and the admin might still be active (as
* indicated by {@link #getActiveAdmins()}) by the time this method returns.
*
* @param admin The administration compononent to remove.
* @throws SecurityException if the caller is not in the owner application of {@code admin}.
*/
public void removeActiveAdmin(@NonNull ComponentName admin) {
throwIfParentInstance("removeActiveAdmin");
if (mService != null) {
try {
mService.removeActiveAdmin(admin, myUserId());
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
}
/**
* Returns true if an administrator has been granted a particular device policy. This can be
* used to check whether the administrator was activated under an earlier set of policies, but
* requires additional policies after an upgrade.
*
* @param admin Which {@link DeviceAdminReceiver} this request is associated with. Must be an
* active administrator, or an exception will be thrown.
* @param usesPolicy Which uses-policy to check, as defined in {@link DeviceAdminInfo}.
* @throws SecurityException if {@code admin} is not an active administrator.
*/
public boolean hasGrantedPolicy(@NonNull ComponentName admin, int usesPolicy) {
throwIfParentInstance("hasGrantedPolicy");
if (mService != null) {
try {
return mService.hasGrantedPolicy(admin, usesPolicy, myUserId());
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return false;
}
/**
* Returns true if the Profile Challenge is available to use for the given profile user.
*
* @hide
*/
public boolean isSeparateProfileChallengeAllowed(int userHandle) {
if (mService != null) {
try {
return mService.isSeparateProfileChallengeAllowed(userHandle);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return false;
}
/**
* Constant for {@link #setPasswordQuality}: the policy has no requirements
* for the password. Note that quality constants are ordered so that higher
* values are more restrictive.
*/
public static final int PASSWORD_QUALITY_UNSPECIFIED = 0;
/**
* Constant for {@link #setPasswordQuality}: the policy allows for low-security biometric
* recognition technology. This implies technologies that can recognize the identity of
* an individual to about a 3 digit PIN (false detection is less than 1 in 1,000).
* Note that quality constants are ordered so that higher values are more restrictive.
*/
public static final int PASSWORD_QUALITY_BIOMETRIC_WEAK = 0x8000;
/**
* Constant for {@link #setPasswordQuality}: the policy requires some kind
* of password or pattern, but doesn't care what it is. Note that quality constants
* are ordered so that higher values are more restrictive.
*/
public static final int PASSWORD_QUALITY_SOMETHING = 0x10000;
/**
* Constant for {@link #setPasswordQuality}: the user must have entered a
* password containing at least numeric characters. Note that quality
* constants are ordered so that higher values are more restrictive.
*/
public static final int PASSWORD_QUALITY_NUMERIC = 0x20000;
/**
* Constant for {@link #setPasswordQuality}: the user must have entered a
* password containing at least numeric characters with no repeating (4444)
* or ordered (1234, 4321, 2468) sequences. Note that quality
* constants are ordered so that higher values are more restrictive.
*/
public static final int PASSWORD_QUALITY_NUMERIC_COMPLEX = 0x30000;
/**
* Constant for {@link #setPasswordQuality}: the user must have entered a
* password containing at least alphabetic (or other symbol) characters.
* Note that quality constants are ordered so that higher values are more
* restrictive.
*/
public static final int PASSWORD_QUALITY_ALPHABETIC = 0x40000;
/**
* Constant for {@link #setPasswordQuality}: the user must have entered a
* password containing at least <em>both></em> numeric <em>and</em>
* alphabetic (or other symbol) characters. Note that quality constants are
* ordered so that higher values are more restrictive.
*/
public static final int PASSWORD_QUALITY_ALPHANUMERIC = 0x50000;
/**
* Constant for {@link #setPasswordQuality}: the user must have entered a
* password containing at least a letter, a numerical digit and a special
* symbol, by default. With this password quality, passwords can be
* restricted to contain various sets of characters, like at least an
* uppercase letter, etc. These are specified using various methods,
* like {@link #setPasswordMinimumLowerCase(ComponentName, int)}. Note
* that quality constants are ordered so that higher values are more
* restrictive.
*/
public static final int PASSWORD_QUALITY_COMPLEX = 0x60000;
/**
* Constant for {@link #setPasswordQuality}: the user is not allowed to
* modify password. In case this password quality is set, the password is
* managed by a profile owner. The profile owner can set any password,
* as if {@link #PASSWORD_QUALITY_UNSPECIFIED} is used. Note
* that quality constants are ordered so that higher values are more
* restrictive. The value of {@link #PASSWORD_QUALITY_MANAGED} is
* the highest.
* @hide
*/
public static final int PASSWORD_QUALITY_MANAGED = 0x80000;
/**
* @hide
*
* adb shell dpm set-{device,profile}-owner will normally not allow installing an owner to
* a user with accounts. {@link #ACCOUNT_FEATURE_DEVICE_OR_PROFILE_OWNER_ALLOWED}
* and {@link #ACCOUNT_FEATURE_DEVICE_OR_PROFILE_OWNER_DISALLOWED} are the account features
* used by authenticator to exempt their accounts from this:
*
* <ul>
* <li>Non-test-only DO/PO still can't be installed when there are accounts.
* <p>In order to make an apk test-only, add android:testOnly="true" to the
* &lt;application&gt; tag in the manifest.
*
* <li>Test-only DO/PO can be installed even when there are accounts, as long as all the
* accounts have the {@link #ACCOUNT_FEATURE_DEVICE_OR_PROFILE_OWNER_ALLOWED} feature.
* Some authenticators claim to have any features, so to detect it, we also check
* {@link #ACCOUNT_FEATURE_DEVICE_OR_PROFILE_OWNER_DISALLOWED} and disallow installing
* if any of the accounts have it.
* </ul>
*/
@SystemApi
@TestApi
public static final String ACCOUNT_FEATURE_DEVICE_OR_PROFILE_OWNER_ALLOWED =
"android.account.DEVICE_OR_PROFILE_OWNER_ALLOWED";
/** @hide See {@link #ACCOUNT_FEATURE_DEVICE_OR_PROFILE_OWNER_ALLOWED} */
@SystemApi
@TestApi
public static final String ACCOUNT_FEATURE_DEVICE_OR_PROFILE_OWNER_DISALLOWED =
"android.account.DEVICE_OR_PROFILE_OWNER_DISALLOWED";
/**
* Called by an application that is administering the device to set the password restrictions it
* is imposing. After setting this, the user will not be able to enter a new password that is
* not at least as restrictive as what has been set. Note that the current password will remain
* until the user has set a new one, so the change does not take place immediately. To prompt
* the user for a new password, use {@link #ACTION_SET_NEW_PASSWORD} or
* {@link #ACTION_SET_NEW_PARENT_PROFILE_PASSWORD} after calling this method.
* <p>
* Quality constants are ordered so that higher values are more restrictive; thus the highest
* requested quality constant (between the policy set here, the user's preference, and any other
* considerations) is the one that is in effect.
* <p>
* The calling device admin must have requested
* {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD} to be able to call this method; if it has
* not, a security exception will be thrown.
* <p>
* This method can be called on the {@link DevicePolicyManager} instance returned by
* {@link #getParentProfileInstance(ComponentName)} in order to set restrictions on the parent
* profile.
*
* @param admin Which {@link DeviceAdminReceiver} this request is associated with.
* @param quality The new desired quality. One of {@link #PASSWORD_QUALITY_UNSPECIFIED},
* {@link #PASSWORD_QUALITY_SOMETHING}, {@link #PASSWORD_QUALITY_NUMERIC},
* {@link #PASSWORD_QUALITY_NUMERIC_COMPLEX}, {@link #PASSWORD_QUALITY_ALPHABETIC},
* {@link #PASSWORD_QUALITY_ALPHANUMERIC} or {@link #PASSWORD_QUALITY_COMPLEX}.
* @throws SecurityException if {@code admin} is not an active administrator or if {@code admin}
* does not use {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD}
*/
public void setPasswordQuality(@NonNull ComponentName admin, int quality) {
if (mService != null) {
try {
mService.setPasswordQuality(admin, quality, mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
}
/**
* Retrieve the current minimum password quality for a particular admin or all admins that set
* restrictions on this user and its participating profiles. Restrictions on profiles that have
* a separate challenge are not taken into account.
*
* <p>This method can be called on the {@link DevicePolicyManager} instance
* returned by {@link #getParentProfileInstance(ComponentName)} in order to retrieve
* restrictions on the parent profile.
*
* @param admin The name of the admin component to check, or {@code null} to aggregate
* all admins.
*/
public int getPasswordQuality(@Nullable ComponentName admin) {
return getPasswordQuality(admin, myUserId());
}
/** @hide per-user version */
@UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.P, trackingBug = 115609023)
public int getPasswordQuality(@Nullable ComponentName admin, int userHandle) {
if (mService != null) {
try {
return mService.getPasswordQuality(admin, userHandle, mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return PASSWORD_QUALITY_UNSPECIFIED;
}
/**
* Called by an application that is administering the device to set the minimum allowed password
* length. After setting this, the user will not be able to enter a new password that is not at
* least as restrictive as what has been set. Note that the current password will remain until
* the user has set a new one, so the change does not take place immediately. To prompt the user
* for a new password, use {@link #ACTION_SET_NEW_PASSWORD} or
* {@link #ACTION_SET_NEW_PARENT_PROFILE_PASSWORD} after setting this value. This constraint is
* only imposed if the administrator has also requested either {@link #PASSWORD_QUALITY_NUMERIC}
* , {@link #PASSWORD_QUALITY_NUMERIC_COMPLEX}, {@link #PASSWORD_QUALITY_ALPHABETIC},
* {@link #PASSWORD_QUALITY_ALPHANUMERIC}, or {@link #PASSWORD_QUALITY_COMPLEX} with
* {@link #setPasswordQuality}.
* <p>
* The calling device admin must have requested
* {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD} to be able to call this method; if it has
* not, a security exception will be thrown.
* <p>
* This method can be called on the {@link DevicePolicyManager} instance returned by
* {@link #getParentProfileInstance(ComponentName)} in order to set restrictions on the parent
* profile.
*
* @param admin Which {@link DeviceAdminReceiver} this request is associated with.
* @param length The new desired minimum password length. A value of 0 means there is no
* restriction.
* @throws SecurityException if {@code admin} is not an active administrator or {@code admin}
* does not use {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD}
*/
public void setPasswordMinimumLength(@NonNull ComponentName admin, int length) {
if (mService != null) {
try {
mService.setPasswordMinimumLength(admin, length, mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
}
/**
* Retrieve the current minimum password length for a particular admin or all admins that set
* restrictions on this user and its participating profiles. Restrictions on profiles that have
* a separate challenge are not taken into account.
*
* <p>This method can be called on the {@link DevicePolicyManager} instance
* returned by {@link #getParentProfileInstance(ComponentName)} in order to retrieve
* restrictions on the parent profile.
*
* user and its profiles or a particular one.
* @param admin The name of the admin component to check, or {@code null} to aggregate
* all admins.
*/
public int getPasswordMinimumLength(@Nullable ComponentName admin) {
return getPasswordMinimumLength(admin, myUserId());
}
/** @hide per-user version */
@UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.P, trackingBug = 115609023)
public int getPasswordMinimumLength(@Nullable ComponentName admin, int userHandle) {
if (mService != null) {
try {
return mService.getPasswordMinimumLength(admin, userHandle, mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return 0;
}
/**
* Called by an application that is administering the device to set the minimum number of upper
* case letters required in the password. After setting this, the user will not be able to enter
* a new password that is not at least as restrictive as what has been set. Note that the
* current password will remain until the user has set a new one, so the change does not take
* place immediately. To prompt the user for a new password, use
* {@link #ACTION_SET_NEW_PASSWORD} or {@link #ACTION_SET_NEW_PARENT_PROFILE_PASSWORD} after
* setting this value. This constraint is only imposed if the administrator has also requested
* {@link #PASSWORD_QUALITY_COMPLEX} with {@link #setPasswordQuality}. The default value is 0.
* <p>
* The calling device admin must have requested
* {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD} to be able to call this method; if it has
* not, a security exception will be thrown.
* <p>
* This method can be called on the {@link DevicePolicyManager} instance returned by
* {@link #getParentProfileInstance(ComponentName)} in order to set restrictions on the parent
* profile.
*
* @param admin Which {@link DeviceAdminReceiver} this request is associated with.
* @param length The new desired minimum number of upper case letters required in the password.
* A value of 0 means there is no restriction.
* @throws SecurityException if {@code admin} is not an active administrator or {@code admin}
* does not use {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD}
*/
public void setPasswordMinimumUpperCase(@NonNull ComponentName admin, int length) {
if (mService != null) {
try {
mService.setPasswordMinimumUpperCase(admin, length, mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
}
/**
* Retrieve the current number of upper case letters required in the password
* for a particular admin or all admins that set restrictions on this user and
* its participating profiles. Restrictions on profiles that have a separate challenge
* are not taken into account.
* This is the same value as set by
* {@link #setPasswordMinimumUpperCase(ComponentName, int)}
* and only applies when the password quality is
* {@link #PASSWORD_QUALITY_COMPLEX}.
*
* <p>This method can be called on the {@link DevicePolicyManager} instance
* returned by {@link #getParentProfileInstance(ComponentName)} in order to retrieve
* restrictions on the parent profile.
*
* @param admin The name of the admin component to check, or {@code null} to
* aggregate all admins.
* @return The minimum number of upper case letters required in the
* password.
*/
public int getPasswordMinimumUpperCase(@Nullable ComponentName admin) {
return getPasswordMinimumUpperCase(admin, myUserId());
}
/** @hide per-user version */
@UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.P, trackingBug = 115609023)
public int getPasswordMinimumUpperCase(@Nullable ComponentName admin, int userHandle) {
if (mService != null) {
try {
return mService.getPasswordMinimumUpperCase(admin, userHandle, mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return 0;
}
/**
* Called by an application that is administering the device to set the minimum number of lower
* case letters required in the password. After setting this, the user will not be able to enter
* a new password that is not at least as restrictive as what has been set. Note that the
* current password will remain until the user has set a new one, so the change does not take
* place immediately. To prompt the user for a new password, use
* {@link #ACTION_SET_NEW_PASSWORD} or {@link #ACTION_SET_NEW_PARENT_PROFILE_PASSWORD} after
* setting this value. This constraint is only imposed if the administrator has also requested
* {@link #PASSWORD_QUALITY_COMPLEX} with {@link #setPasswordQuality}. The default value is 0.
* <p>
* The calling device admin must have requested
* {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD} to be able to call this method; if it has
* not, a security exception will be thrown.
* <p>
* This method can be called on the {@link DevicePolicyManager} instance returned by
* {@link #getParentProfileInstance(ComponentName)} in order to set restrictions on the parent
* profile.
*
* @param admin Which {@link DeviceAdminReceiver} this request is associated with.
* @param length The new desired minimum number of lower case letters required in the password.
* A value of 0 means there is no restriction.
* @throws SecurityException if {@code admin} is not an active administrator or {@code admin}
* does not use {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD}
*/
public void setPasswordMinimumLowerCase(@NonNull ComponentName admin, int length) {
if (mService != null) {
try {
mService.setPasswordMinimumLowerCase(admin, length, mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
}
/**
* Retrieve the current number of lower case letters required in the password
* for a particular admin or all admins that set restrictions on this user
* and its participating profiles. Restrictions on profiles that have
* a separate challenge are not taken into account.
* This is the same value as set by
* {@link #setPasswordMinimumLowerCase(ComponentName, int)}
* and only applies when the password quality is
* {@link #PASSWORD_QUALITY_COMPLEX}.
*
* <p>This method can be called on the {@link DevicePolicyManager} instance
* returned by {@link #getParentProfileInstance(ComponentName)} in order to retrieve
* restrictions on the parent profile.
*
* @param admin The name of the admin component to check, or {@code null} to
* aggregate all admins.
* @return The minimum number of lower case letters required in the
* password.
*/
public int getPasswordMinimumLowerCase(@Nullable ComponentName admin) {
return getPasswordMinimumLowerCase(admin, myUserId());
}
/** @hide per-user version */
@UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.P, trackingBug = 115609023)
public int getPasswordMinimumLowerCase(@Nullable ComponentName admin, int userHandle) {
if (mService != null) {
try {
return mService.getPasswordMinimumLowerCase(admin, userHandle, mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return 0;
}
/**
* Called by an application that is administering the device to set the minimum number of
* letters required in the password. After setting this, the user will not be able to enter a
* new password that is not at least as restrictive as what has been set. Note that the current
* password will remain until the user has set a new one, so the change does not take place
* immediately. To prompt the user for a new password, use {@link #ACTION_SET_NEW_PASSWORD} or
* {@link #ACTION_SET_NEW_PARENT_PROFILE_PASSWORD} after setting this value. This constraint is
* only imposed if the administrator has also requested {@link #PASSWORD_QUALITY_COMPLEX} with
* {@link #setPasswordQuality}. The default value is 1.
* <p>
* The calling device admin must have requested
* {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD} to be able to call this method; if it has
* not, a security exception will be thrown.
* <p>
* This method can be called on the {@link DevicePolicyManager} instance returned by
* {@link #getParentProfileInstance(ComponentName)} in order to set restrictions on the parent
* profile.
*
* @param admin Which {@link DeviceAdminReceiver} this request is associated with.
* @param length The new desired minimum number of letters required in the password. A value of
* 0 means there is no restriction.
* @throws SecurityException if {@code admin} is not an active administrator or {@code admin}
* does not use {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD}
*/
public void setPasswordMinimumLetters(@NonNull ComponentName admin, int length) {
if (mService != null) {
try {
mService.setPasswordMinimumLetters(admin, length, mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
}
/**
* Retrieve the current number of letters required in the password
* for a particular admin or all admins that set restrictions on this user
* and its participating profiles. Restrictions on profiles that have
* a separate challenge are not taken into account.
* This is the same value as set by
* {@link #setPasswordMinimumLetters(ComponentName, int)}
* and only applies when the password quality is
* {@link #PASSWORD_QUALITY_COMPLEX}.
*
* <p>This method can be called on the {@link DevicePolicyManager} instance
* returned by {@link #getParentProfileInstance(ComponentName)} in order to retrieve
* restrictions on the parent profile.
*
* @param admin The name of the admin component to check, or {@code null} to
* aggregate all admins.
* @return The minimum number of letters required in the password.
*/
public int getPasswordMinimumLetters(@Nullable ComponentName admin) {
return getPasswordMinimumLetters(admin, myUserId());
}
/** @hide per-user version */
@UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.P, trackingBug = 115609023)
public int getPasswordMinimumLetters(@Nullable ComponentName admin, int userHandle) {
if (mService != null) {
try {
return mService.getPasswordMinimumLetters(admin, userHandle, mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return 0;
}
/**
* Called by an application that is administering the device to set the minimum number of
* numerical digits required in the password. After setting this, the user will not be able to
* enter a new password that is not at least as restrictive as what has been set. Note that the
* current password will remain until the user has set a new one, so the change does not take
* place immediately. To prompt the user for a new password, use
* {@link #ACTION_SET_NEW_PASSWORD} or {@link #ACTION_SET_NEW_PARENT_PROFILE_PASSWORD} after
* setting this value. This constraint is only imposed if the administrator has also requested
* {@link #PASSWORD_QUALITY_COMPLEX} with {@link #setPasswordQuality}. The default value is 1.
* <p>
* The calling device admin must have requested
* {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD} to be able to call this method; if it has
* not, a security exception will be thrown.
* <p>
* This method can be called on the {@link DevicePolicyManager} instance returned by
* {@link #getParentProfileInstance(ComponentName)} in order to set restrictions on the parent
* profile.
*
* @param admin Which {@link DeviceAdminReceiver} this request is associated with.
* @param length The new desired minimum number of numerical digits required in the password. A
* value of 0 means there is no restriction.
* @throws SecurityException if {@code admin} is not an active administrator or {@code admin}
* does not use {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD}
*/
public void setPasswordMinimumNumeric(@NonNull ComponentName admin, int length) {
if (mService != null) {
try {
mService.setPasswordMinimumNumeric(admin, length, mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
}
/**
* Retrieve the current number of numerical digits required in the password
* for a particular admin or all admins that set restrictions on this user
* and its participating profiles. Restrictions on profiles that have
* a separate challenge are not taken into account.
* This is the same value as set by
* {@link #setPasswordMinimumNumeric(ComponentName, int)}
* and only applies when the password quality is
* {@link #PASSWORD_QUALITY_COMPLEX}.
*
* <p>This method can be called on the {@link DevicePolicyManager} instance
* returned by {@link #getParentProfileInstance(ComponentName)} in order to retrieve
* restrictions on the parent profile.
*
* @param admin The name of the admin component to check, or {@code null} to
* aggregate all admins.
* @return The minimum number of numerical digits required in the password.
*/
public int getPasswordMinimumNumeric(@Nullable ComponentName admin) {
return getPasswordMinimumNumeric(admin, myUserId());
}
/** @hide per-user version */
@UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.P, trackingBug = 115609023)
public int getPasswordMinimumNumeric(@Nullable ComponentName admin, int userHandle) {
if (mService != null) {
try {
return mService.getPasswordMinimumNumeric(admin, userHandle, mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return 0;
}
/**
* Called by an application that is administering the device to set the minimum number of
* symbols required in the password. After setting this, the user will not be able to enter a
* new password that is not at least as restrictive as what has been set. Note that the current
* password will remain until the user has set a new one, so the change does not take place
* immediately. To prompt the user for a new password, use {@link #ACTION_SET_NEW_PASSWORD} or
* {@link #ACTION_SET_NEW_PARENT_PROFILE_PASSWORD} after setting this value. This constraint is
* only imposed if the administrator has also requested {@link #PASSWORD_QUALITY_COMPLEX} with
* {@link #setPasswordQuality}. The default value is 1.
* <p>
* The calling device admin must have requested
* {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD} to be able to call this method; if it has
* not, a security exception will be thrown.
* <p>
* This method can be called on the {@link DevicePolicyManager} instance returned by
* {@link #getParentProfileInstance(ComponentName)} in order to set restrictions on the parent
* profile.
*
* @param admin Which {@link DeviceAdminReceiver} this request is associated with.
* @param length The new desired minimum number of symbols required in the password. A value of
* 0 means there is no restriction.
* @throws SecurityException if {@code admin} is not an active administrator or {@code admin}
* does not use {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD}
*/
public void setPasswordMinimumSymbols(@NonNull ComponentName admin, int length) {
if (mService != null) {
try {
mService.setPasswordMinimumSymbols(admin, length, mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
}
/**
* Retrieve the current number of symbols required in the password
* for a particular admin or all admins that set restrictions on this user
* and its participating profiles. Restrictions on profiles that have
* a separate challenge are not taken into account. This is the same value as
* set by {@link #setPasswordMinimumSymbols(ComponentName, int)}
* and only applies when the password quality is
* {@link #PASSWORD_QUALITY_COMPLEX}.
*
* <p>This method can be called on the {@link DevicePolicyManager} instance
* returned by {@link #getParentProfileInstance(ComponentName)} in order to retrieve
* restrictions on the parent profile.
*
* @param admin The name of the admin component to check, or {@code null} to
* aggregate all admins.
* @return The minimum number of symbols required in the password.
*/
public int getPasswordMinimumSymbols(@Nullable ComponentName admin) {
return getPasswordMinimumSymbols(admin, myUserId());
}
/** @hide per-user version */
@UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.P, trackingBug = 115609023)
public int getPasswordMinimumSymbols(@Nullable ComponentName admin, int userHandle) {
if (mService != null) {
try {
return mService.getPasswordMinimumSymbols(admin, userHandle, mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return 0;
}
/**
* Called by an application that is administering the device to set the minimum number of
* non-letter characters (numerical digits or symbols) required in the password. After setting
* this, the user will not be able to enter a new password that is not at least as restrictive
* as what has been set. Note that the current password will remain until the user has set a new
* one, so the change does not take place immediately. To prompt the user for a new password,
* use {@link #ACTION_SET_NEW_PASSWORD} or {@link #ACTION_SET_NEW_PARENT_PROFILE_PASSWORD} after
* setting this value. This constraint is only imposed if the administrator has also requested
* {@link #PASSWORD_QUALITY_COMPLEX} with {@link #setPasswordQuality}. The default value is 0.
* <p>
* The calling device admin must have requested
* {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD} to be able to call this method; if it has
* not, a security exception will be thrown.
* <p>
* This method can be called on the {@link DevicePolicyManager} instance returned by
* {@link #getParentProfileInstance(ComponentName)} in order to set restrictions on the parent
* profile.
*
* @param admin Which {@link DeviceAdminReceiver} this request is associated with.
* @param length The new desired minimum number of letters required in the password. A value of
* 0 means there is no restriction.
* @throws SecurityException if {@code admin} is not an active administrator or {@code admin}
* does not use {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD}
*/
public void setPasswordMinimumNonLetter(@NonNull ComponentName admin, int length) {
if (mService != null) {
try {
mService.setPasswordMinimumNonLetter(admin, length, mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
}
/**
* Retrieve the current number of non-letter characters required in the password
* for a particular admin or all admins that set restrictions on this user
* and its participating profiles. Restrictions on profiles that have
* a separate challenge are not taken into account.
* This is the same value as set by
* {@link #setPasswordMinimumNonLetter(ComponentName, int)}
* and only applies when the password quality is
* {@link #PASSWORD_QUALITY_COMPLEX}.
*
* <p>This method can be called on the {@link DevicePolicyManager} instance
* returned by {@link #getParentProfileInstance(ComponentName)} in order to retrieve
* restrictions on the parent profile.
*
* @param admin The name of the admin component to check, or {@code null} to
* aggregate all admins.
* @return The minimum number of letters required in the password.
*/
public int getPasswordMinimumNonLetter(@Nullable ComponentName admin) {
return getPasswordMinimumNonLetter(admin, myUserId());
}
/** @hide per-user version */
@UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.P, trackingBug = 115609023)
public int getPasswordMinimumNonLetter(@Nullable ComponentName admin, int userHandle) {
if (mService != null) {
try {
return mService.getPasswordMinimumNonLetter(admin, userHandle, mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return 0;
}
/**
* Called by an application that is administering the device to set the length of the password
* history. After setting this, the user will not be able to enter a new password that is the
* same as any password in the history. Note that the current password will remain until the
* user has set a new one, so the change does not take place immediately. To prompt the user for
* a new password, use {@link #ACTION_SET_NEW_PASSWORD} or
* {@link #ACTION_SET_NEW_PARENT_PROFILE_PASSWORD} after setting this value. This constraint is
* only imposed if the administrator has also requested either {@link #PASSWORD_QUALITY_NUMERIC}
* , {@link #PASSWORD_QUALITY_NUMERIC_COMPLEX} {@link #PASSWORD_QUALITY_ALPHABETIC}, or
* {@link #PASSWORD_QUALITY_ALPHANUMERIC} with {@link #setPasswordQuality}.
* <p>
* The calling device admin must have requested
* {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD} to be able to call this method; if it has
* not, a security exception will be thrown.
* <p>
* This method can be called on the {@link DevicePolicyManager} instance returned by
* {@link #getParentProfileInstance(ComponentName)} in order to set restrictions on the parent
* profile.
*
* @param admin Which {@link DeviceAdminReceiver} this request is associated with.
* @param length The new desired length of password history. A value of 0 means there is no
* restriction.
* @throws SecurityException if {@code admin} is not an active administrator or {@code admin}
* does not use {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD}
*/
public void setPasswordHistoryLength(@NonNull ComponentName admin, int length) {
if (mService != null) {
try {
mService.setPasswordHistoryLength(admin, length, mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
}
/**
* Called by a device admin to set the password expiration timeout. Calling this method will
* restart the countdown for password expiration for the given admin, as will changing the
* device password (for all admins).
* <p>
* The provided timeout is the time delta in ms and will be added to the current time. For
* example, to have the password expire 5 days from now, timeout would be 5 * 86400 * 1000 =
* 432000000 ms for timeout.
* <p>
* To disable password expiration, a value of 0 may be used for timeout.
* <p>
* The calling device admin must have requested
* {@link DeviceAdminInfo#USES_POLICY_EXPIRE_PASSWORD} to be able to call this method; if it has
* not, a security exception will be thrown.
* <p>
* Note that setting the password will automatically reset the expiration time for all active
* admins. Active admins do not need to explicitly call this method in that case.
* <p>
* This method can be called on the {@link DevicePolicyManager} instance returned by
* {@link #getParentProfileInstance(ComponentName)} in order to set restrictions on the parent
* profile.
*
* @param admin Which {@link DeviceAdminReceiver} this request is associated with.
* @param timeout The limit (in ms) that a password can remain in effect. A value of 0 means
* there is no restriction (unlimited).
* @throws SecurityException if {@code admin} is not an active administrator or {@code admin}
* does not use {@link DeviceAdminInfo#USES_POLICY_EXPIRE_PASSWORD}
*/
public void setPasswordExpirationTimeout(@NonNull ComponentName admin, long timeout) {
if (mService != null) {
try {
mService.setPasswordExpirationTimeout(admin, timeout, mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
}
/**
* Get the password expiration timeout for the given admin. The expiration timeout is the
* recurring expiration timeout provided in the call to
* {@link #setPasswordExpirationTimeout(ComponentName, long)} for the given admin or the
* aggregate of all participating policy administrators if {@code admin} is null. Admins that
* have set restrictions on profiles that have a separate challenge are not taken into account.
*
* <p>This method can be called on the {@link DevicePolicyManager} instance
* returned by {@link #getParentProfileInstance(ComponentName)} in order to retrieve
* restrictions on the parent profile.
*
* @param admin The name of the admin component to check, or {@code null} to aggregate all admins.
* @return The timeout for the given admin or the minimum of all timeouts
*/
public long getPasswordExpirationTimeout(@Nullable ComponentName admin) {
if (mService != null) {
try {
return mService.getPasswordExpirationTimeout(admin, myUserId(), mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return 0;
}
/**
* Get the current password expiration time for a particular admin or all admins that set
* restrictions on this user and its participating profiles. Restrictions on profiles that have
* a separate challenge are not taken into account. If admin is {@code null}, then a composite
* of all expiration times is returned - which will be the minimum of all of them.
*
* <p>This method can be called on the {@link DevicePolicyManager} instance
* returned by {@link #getParentProfileInstance(ComponentName)} in order to retrieve
* the password expiration for the parent profile.
*
* @param admin The name of the admin component to check, or {@code null} to aggregate all admins.
* @return The password expiration time, in milliseconds since epoch.
*/
public long getPasswordExpiration(@Nullable ComponentName admin) {
if (mService != null) {
try {
return mService.getPasswordExpiration(admin, myUserId(), mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return 0;
}
/**
* Retrieve the current password history length for a particular admin or all admins that
* set restrictions on this user and its participating profiles. Restrictions on profiles that
* have a separate challenge are not taken into account.
*
* <p>This method can be called on the {@link DevicePolicyManager} instance
* returned by {@link #getParentProfileInstance(ComponentName)} in order to retrieve
* restrictions on the parent profile.
*
* @param admin The name of the admin component to check, or {@code null} to aggregate
* all admins.
* @return The length of the password history
*/
public int getPasswordHistoryLength(@Nullable ComponentName admin) {
return getPasswordHistoryLength(admin, myUserId());
}
/** @hide per-user version */
@UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.P, trackingBug = 115609023)
public int getPasswordHistoryLength(@Nullable ComponentName admin, int userHandle) {
if (mService != null) {
try {
return mService.getPasswordHistoryLength(admin, userHandle, mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return 0;
}
/**
* Return the maximum password length that the device supports for a
* particular password quality.
* @param quality The quality being interrogated.
* @return Returns the maximum length that the user can enter.
*/
public int getPasswordMaximumLength(int quality) {
// Kind-of arbitrary.
return 16;
}
/**
* Determine whether the current password the user has set is sufficient to meet the policy
* requirements (e.g. quality, minimum length) that have been requested by the admins of this
* user and its participating profiles. Restrictions on profiles that have a separate challenge
* are not taken into account. The user must be unlocked in order to perform the check.
* <p>
* The calling device admin must have requested
* {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD} to be able to call this method; if it has
* not, a security exception will be thrown.
* <p>
* This method can be called on the {@link DevicePolicyManager} instance returned by
* {@link #getParentProfileInstance(ComponentName)} in order to determine if the password set on
* the parent profile is sufficient.
*
* @return Returns true if the password meets the current requirements, else false.
* @throws SecurityException if the calling application does not own an active administrator
* that uses {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD}
* @throws IllegalStateException if the user is not unlocked.
*/
public boolean isActivePasswordSufficient() {
if (mService != null) {
try {
return mService.isActivePasswordSufficient(myUserId(), mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return false;
}
/**
* When called by a profile owner of a managed profile returns true if the profile uses unified
* challenge with its parent user.
*
* <strong>Note</strong>: This method is not concerned with password quality and will return
* false if the profile has empty password as a separate challenge.
*
* @param admin Which {@link DeviceAdminReceiver} this request is associated with.
* @throws SecurityException if {@code admin} is not a profile owner of a managed profile.
* @see UserManager#DISALLOW_UNIFIED_PASSWORD
*/
public boolean isUsingUnifiedPassword(@NonNull ComponentName admin) {
throwIfParentInstance("isUsingUnifiedPassword");
if (mService != null) {
try {
return mService.isUsingUnifiedPassword(admin);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return true;
}
/**
* Determine whether the current profile password the user has set is sufficient
* to meet the policy requirements (e.g. quality, minimum length) that have been
* requested by the admins of the parent user and its profiles.
*
* @param userHandle the userId of the profile to check the password for.
* @return Returns true if the password would meet the current requirements, else false.
* @throws SecurityException if {@code userHandle} is not a managed profile.
* @hide
*/
public boolean isProfileActivePasswordSufficientForParent(int userHandle) {
if (mService != null) {
try {
return mService.isProfileActivePasswordSufficientForParent(userHandle);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return false;
}
/**
* Retrieve the number of times the user has failed at entering a password since that last
* successful password entry.
* <p>
* This method can be called on the {@link DevicePolicyManager} instance returned by
* {@link #getParentProfileInstance(ComponentName)} in order to retrieve the number of failed
* password attemts for the parent user.
* <p>
* The calling device admin must have requested {@link DeviceAdminInfo#USES_POLICY_WATCH_LOGIN}
* to be able to call this method; if it has not, a security exception will be thrown.
*
* @return The number of times user has entered an incorrect password since the last correct
* password entry.
* @throws SecurityException if the calling application does not own an active administrator
* that uses {@link DeviceAdminInfo#USES_POLICY_WATCH_LOGIN}
*/
public int getCurrentFailedPasswordAttempts() {
return getCurrentFailedPasswordAttempts(myUserId());
}
/**
* Retrieve the number of times the given user has failed at entering a
* password since that last successful password entry.
*
* <p>The calling device admin must have requested
* {@link DeviceAdminInfo#USES_POLICY_WATCH_LOGIN} to be able to call this method; if it has
* not and it is not the system uid, a security exception will be thrown.
*
* @hide
*/
@UnsupportedAppUsage
public int getCurrentFailedPasswordAttempts(int userHandle) {
if (mService != null) {
try {
return mService.getCurrentFailedPasswordAttempts(userHandle, mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return -1;
}
/**
* Queries whether {@link #RESET_PASSWORD_DO_NOT_ASK_CREDENTIALS_ON_BOOT} flag is set.
*
* @return true if RESET_PASSWORD_DO_NOT_ASK_CREDENTIALS_ON_BOOT flag is set.
* @hide
*/
public boolean getDoNotAskCredentialsOnBoot() {
if (mService != null) {
try {
return mService.getDoNotAskCredentialsOnBoot();
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return false;
}
/**
* Setting this to a value greater than zero enables a built-in policy that will perform a
* device or profile wipe after too many incorrect device-unlock passwords have been entered.
* This built-in policy combines watching for failed passwords and wiping the device, and
* requires that you request both {@link DeviceAdminInfo#USES_POLICY_WATCH_LOGIN} and
* {@link DeviceAdminInfo#USES_POLICY_WIPE_DATA}}.
* <p>
* To implement any other policy (e.g. wiping data for a particular application only, erasing or
* revoking credentials, or reporting the failure to a server), you should implement
* {@link DeviceAdminReceiver#onPasswordFailed(Context, android.content.Intent)} instead. Do not
* use this API, because if the maximum count is reached, the device or profile will be wiped
* immediately, and your callback will not be invoked.
* <p>
* This method can be called on the {@link DevicePolicyManager} instance returned by
* {@link #getParentProfileInstance(ComponentName)} in order to set a value on the parent
* profile.
*
* @param admin Which {@link DeviceAdminReceiver} this request is associated with.
* @param num The number of failed password attempts at which point the device or profile will
* be wiped.
* @throws SecurityException if {@code admin} is not an active administrator or does not use
* both {@link DeviceAdminInfo#USES_POLICY_WATCH_LOGIN} and
* {@link DeviceAdminInfo#USES_POLICY_WIPE_DATA}.
*/
public void setMaximumFailedPasswordsForWipe(@NonNull ComponentName admin, int num) {
if (mService != null) {
try {
mService.setMaximumFailedPasswordsForWipe(admin, num, mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
}
/**
* Retrieve the current maximum number of login attempts that are allowed before the device
* or profile is wiped, for a particular admin or all admins that set restrictions on this user
* and its participating profiles. Restrictions on profiles that have a separate challenge are
* not taken into account.
*
* <p>This method can be called on the {@link DevicePolicyManager} instance
* returned by {@link #getParentProfileInstance(ComponentName)} in order to retrieve
* the value for the parent profile.
*
* @param admin The name of the admin component to check, or {@code null} to aggregate
* all admins.
*/
public int getMaximumFailedPasswordsForWipe(@Nullable ComponentName admin) {
return getMaximumFailedPasswordsForWipe(admin, myUserId());
}
/** @hide per-user version */
@UnsupportedAppUsage
public int getMaximumFailedPasswordsForWipe(@Nullable ComponentName admin, int userHandle) {
if (mService != null) {
try {
return mService.getMaximumFailedPasswordsForWipe(
admin, userHandle, mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return 0;
}
/**
* Returns the profile with the smallest maximum failed passwords for wipe,
* for the given user. So for primary user, it might return the primary or
* a managed profile. For a secondary user, it would be the same as the
* user passed in.
* @hide Used only by Keyguard
*/
public int getProfileWithMinimumFailedPasswordsForWipe(int userHandle) {
if (mService != null) {
try {
return mService.getProfileWithMinimumFailedPasswordsForWipe(
userHandle, mParentInstance);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}
return UserHandle.USER_NULL;
}
/**
* Flag for {@link #resetPasswordWithToken} and {@link #resetPassword}: don't allow other admins
* to change the password again until the user has entered it.
*/
public static final int RESET_PASSWORD_REQUIRE_ENTRY = 0x0001;
/**
* Flag for {@link #resetPasswordWithToken} and {@link #resetPassword}: don't ask for user
* credentials on device boot.
* If the flag is set, the device can be booted without asking for user password.
* The absence of this flag does not change the current boot requirements. This flag
* can be set by the device owner only. If the app is not the device owner, the flag
* is ignored. Once the flag is set, it cannot be reverted back without resetting the
* device to factory defaults.
*/
public static final int RESET_PASSWORD_DO_NOT_ASK_CREDENTIALS_ON_BOOT = 0x0002;
/**
* Force a new password for device unlock (the password needed to access the entire device) or
* the work profile challenge on the current user. This takes effect immediately.
* <p>
* <em>For device owner and profile owners targeting SDK level
* {@link android.os.Build.VERSION_CODES#O} or above, this API is no longer available and will
* throw {@link SecurityException}. Please use the new API {@link #resetPasswordWithToken}
* instead. </em>
* <p>
* <em>Note: This API has been limited as of {@link android.os.Build.VERSION_CODES#N} for
* device admins that are not device owner and not profile owner.
* The password can now only be changed if there is currently no password set. Device owner
* and profile owner can still do this when user is unlocked and does not have a managed
* profile.</em>
* <p>
* The given password must be sufficient for the current password quality and length constraints
* as returned by {@link #getPasswordQuality(ComponentName)} and
* {@link #getPasswordMinimumLength(ComponentName)}; if it does not meet these constraints, then
* it will be rejected and false returned. Note that the password may be a stronger quality
* (containing alphanumeric characters when the requested quality is only numeric), in which
* case the currently active quality will be increased to match.
* <p>
* Calling with a null or empty password will clear any existing PIN, pattern or password if the
* current password constraints allow it. <em>Note: This will not work in
* {@link android.os.Build.VERSION_CODES#N} and later for managed profiles, or for device admins
* that are not device owner or profile owner. Once set, the password cannot be changed to null
* or empty except by these admins.</em>
* <p>
* The calling device admin must have requested
* {@link DeviceAdminInfo#USES_POLICY_RESET_PASSWORD} to be able to call this method; if it has
* not, a security exception will be thrown.
*
* @param password The new password for the user. Null or empty clears the password.
* @param flags May be 0 or combination of {@link #RESET_PASSWORD_REQUIRE_ENTRY} and
* {@link #RESET_PASSWORD_DO_NOT_ASK_CREDENTIALS_ON_BOOT}.
* @return Returns true if the password was applied, or false if it is not acceptable for the
* current constraints or if the user has not been decrypted yet.
* @throws SecurityException if the calling application does not own an active administrator
* that uses {@link DeviceAdminInfo#USES_POLICY_RESET_PASSWORD}
* @throws IllegalStateException if the calling user is locked or has a managed profile.
*/
public boolean resetPassword(String password, int flags) {
throwIfParentInstance("resetPassword");
if (mService != null) {
try {
return mService.resetPassword(password, flags);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
}</