authgear / authgear/authgear-server

AccountManagerPersistentTokenStorage on Android

Open
#1,477 0 comments 0 reactions 1 assignee Claimed by @louischan-oursky View on GitHub
Dominant language
Go
Stars
2k
Forks
125
Avg merge
2d 17h
Merged PRs (30d)
32

Description

The official way to store account is via [Account Manager API](https://developer.android.com/training/id-auth)
This API allows us to store an account in the device.

The security of Account Manager is documented [here](https://developer.android.com/training/id-auth/custom_auth#Security). In particular, the data are stored in plaintext. Our implementation primarily uses two methods of AccountManager, namely [addAccountExplicitly](https://developer.android.com/reference/android/accounts/AccountManager#addAccountExplicitly(android.accounts.Account,%20java.lang.String,%20android.os.Bundle,%20java.util.Map%3Cjava.lang.String,%20java.lang.Integer%3E)) and [getAccountsByType](https://developer.android.com/reference/android/accounts/AccountManager#getAccountsByType(java.lang.String))

In particular, we will set visibility to only allow specific application to be able to retrieve the accounts.

```java
AccountManager accountManager = AccountManager.get(MainActivity.this);
Account account = new Account("Account Name", "authgear");
accountManager.setUserData(account, "refresh_token", "my_refresh_token");
Map visibility = new HashMap<>();
visibility.put("com.company.anotherapp", AccountManager.VISIBILITY_VISIBLE);
visibility.put(AccountManager.PACKAGE_NAME_KEY_LEGACY_VISIBLE, AccountManager.VISIBILITY_NOT_VISIBLE);
visibility.put(AccountManager.PACKAGE_NAME_KEY_LEGACY_NOT_VISIBLE, AccountManager.VISIBILITY_NOT_VISIBLE);
accountManager.addAccountExplicitly(account, null, null, visibility);
```

```xml





```

```xml

```

```xml

```

Note that visibility is NOT honored if the two applications are signed with the same key.

In summary, app group implementation on Android has the following requirements

- The applications in the same group must be signed with the same key.
- Applications belonging to different groups must be signed with different key.

---

## Implementation Notes

- The account name is a user-facing label that will be seen in Settings -> Accounts. So we have to think about a suitable default value for it.
- The authenticator label must be `@string/some_id` instead of a plain string. We should have a guide to teach the developer to prepare `xml/authenticator.xml` and `xml/account_preferences.xml`.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.