authgear / authgear/authgear-server
AccountManagerPersistentTokenStorage on Android
- Dominant language
- Go
- Stars
- 2k
- Forks
- 125
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 32
Description
The official way to store account is via [Account Manager API](https://developer.android.com/training/id-auth)
This API allows us to store an account in the device.
The security of Account Manager is documented [here](https://developer.android.com/training/id-auth/custom_auth#Security). In particular, the data are stored in plaintext. Our implementation primarily uses two methods of AccountManager, namely [addAccountExplicitly](https://developer.android.com/reference/android/accounts/AccountManager#addAccountExplicitly(android.accounts.Account,%20java.lang.String,%20android.os.Bundle,%20java.util.Map%3Cjava.lang.String,%20java.lang.Integer%3E)) and [getAccountsByType](https://developer.android.com/reference/android/accounts/AccountManager#getAccountsByType(java.lang.String))
In particular, we will set visibility to only allow specific application to be able to retrieve the accounts.
```java
AccountManager accountManager = AccountManager.get(MainActivity.this);
Account account = new Account("Account Name", "authgear");
accountManager.setUserData(account, "refresh_token", "my_refresh_token");
Map visibility = new HashMap<>();
visibility.put("com.company.anotherapp", AccountManager.VISIBILITY_VISIBLE);
visibility.put(AccountManager.PACKAGE_NAME_KEY_LEGACY_VISIBLE, AccountManager.VISIBILITY_NOT_VISIBLE);
visibility.put(AccountManager.PACKAGE_NAME_KEY_LEGACY_NOT_VISIBLE, AccountManager.VISIBILITY_NOT_VISIBLE);
accountManager.addAccountExplicitly(account, null, null, visibility);
```
```xml
```
```xml
```
```xml
```
Note that visibility is NOT honored if the two applications are signed with the same key.
In summary, app group implementation on Android has the following requirements
- The applications in the same group must be signed with the same key.
- Applications belonging to different groups must be signed with different key.
---
## Implementation Notes
- The account name is a user-facing label that will be seen in Settings -> Accounts. So we have to think about a suitable default value for it.
- The authenticator label must be `@string/some_id` instead of a plain string. We should have a guide to teach the developer to prepare `xml/authenticator.xml` and `xml/account_preferences.xml`.
Contributor guide
Assessment
This issue has not been assessed yet.