Added in [version 37.2](https://developer.android.com/topic/libraries/support-library/revisions) Summary: [Constants](https://developer.android.com/reference/android/security/authenticationpolicy/AuthenticationPolicyManager#constants) \| [Methods](https://developer.android.com/reference/android/security/authenticationpolicy/AuthenticationPolicyManager#pubmethods) \| [Inherited Methods](https://developer.android.com/reference/android/security/authenticationpolicy/AuthenticationPolicyManager#inhmethods)
# AuthenticationPolicyManager
*** ** * ** ***
`
public
final
class
AuthenticationPolicyManager
`
`
extends https://developer.android.com/reference/java/lang/Object
`
`
`
|---|---|
| [java.lang.Object](https://developer.android.com/reference/java/lang/Object) ||
| ↳ | android.security.authenticationpolicy.AuthenticationPolicyManager |
*** ** * ** ***
AuthenticationPolicyManager is a centralized interface for managing authentication related
policies on the device.
AuthenticationPolicyManager is designed to protect Android users by integrating with apps and
key system components, such as the lock screen. It is not related to enterprise control surfaces
and does not offer additional administrative controls.
### Secure Lock
Secure lockdown includes a set of device locking capabilities to protect users in "at risk" environments.
To use secure lock, call `https://developer.android.com/` to enable it on the device.
This will require the caller to have the
`https://developer.android.com/` permission.
To disable secure lock on the device, call `https://developer.android.com/`. This will require
the caller to have the `https://developer.android.com/` permission.
To check if the device meets the requirements to enable secure lock, call
`https://developer.android.com/`. This will require the caller to have the
`https://developer.android.com/` permission.
To check if secure lock is already enabled on the device, call
`https://developer.android.com/`. This will require the caller to have the
`https://developer.android.com/` permission.
To listen for changes in the availability or enabled / disabled status of Secure Lock Device,
register a `https://developer.android.com/` using
`https://developer.android.com/`.
To unregister a previously registered listener, use
`https://developer.android.com/`.
### Cross Device Authentication Framework
AuthenticationPolicyManager exposes a set of methods that can be used by privileged components to gate access to select functionality.
This will require the caller to have the
`https://developer.android.com/` permission.
Cross device access requests can be initiated on one device by calling
`https://developer.android.com/reference/android/security/authenticationpolicy/AuthenticationPolicyManager#createCrossDeviceAuthenticationRequest(java.util.UUID,%20java.util.concurrent.Executor,%20android.os.OutcomeReceiver)`.
The returned token should be transmitted to another device, via any means, and the receiving
service should then use that token to call
`https://developer.android.com/`
before executing the request. This ensures that a common set of security checks are
verified before executing the request and it decouples many form factor specific checks from
the service being guarded.
## Summary
| ### Constants ||
|---|---|
| `https://developer.android.com/reference/java/lang/String` | `https://developer.android.com/reference/android/security/authenticationpolicy/AuthenticationPolicyManager#PROPERTY_CROSS_DEVICE_TRUSTED_CERTIFICATES` An optional property that applications can define in their manifest's `` element on the **target device** (the receiver of the request) to specify trusted signing certificates for cross-device authentication requests. |
| `https://developer.android.com/reference/java/lang/String` | `https://developer.android.com/reference/android/security/authenticationpolicy/AuthenticationPolicyManager#PROPERTY_CROSS_DEVICE_TRUSTED_PACKAGES` An optional property that applications can define in their manifest's `` element on the **originating device** (the sender of the request) to specify package name aliases. |
| ### Public methods ||
|---|---|
| ` void` | ` https://developer.android.com/reference/android/security/authenticationpolicy/AuthenticationPolicyManager#createCrossDeviceAuthenticationRequest(java.util.UUID,%20java.util.concurrent.Executor,%20android.os.OutcomeReceiver)(https://developer.android.com/reference/java/util/UUID associationToken, https://developer.android.com/reference/java/util/concurrent/Executor callbackExecutor, https://developer.android.com/reference/android/os/OutcomeReceiver callback) ` Creates a new cross-device authentication request associated with the given `https://developer.android.com/reference/android/companion/CompanionDeviceManager`'s obfuscated remote device ID. |
### Inherited methods
From class `
https://developer.android.com/reference/java/lang/Object
` `
https://developer.android.com/reference/java/lang/Object` `
https://developer.android.com/reference/java/lang/Object#clone()()
`
Creates and returns a copy of this object.
`
boolean` `
https://developer.android.com/reference/java/lang/Object#equals(java.lang.Object)(https://developer.android.com/reference/java/lang/Object obj)
`
Indicates whether some other object is "equal to" this one.
`
void` `
https://developer.android.com/reference/java/lang/Object#finalize()()
`
Called by the garbage collector on an object when garbage collection
determines that there are no more references to the object.
`
final
https://developer.android.com/reference/java/lang/Class` `
https://developer.android.com/reference/java/lang/Object#getClass()()
`
Returns the runtime class of this `Object`.
`
int` `
https://developer.android.com/reference/java/lang/Object#hashCode()()
`
Returns a hash code value for the object.
`
final
void` `
https://developer.android.com/reference/java/lang/Object#notify()()
`
Wakes up a single thread that is waiting on this object's
monitor.
`
final
void` `
https://developer.android.com/reference/java/lang/Object#notifyAll()()
`
Wakes up all threads that are waiting on this object's monitor.
`
https://developer.android.com/reference/java/lang/String` `
https://developer.android.com/reference/java/lang/Object#toString()()
`
Returns a string representation of the object.
`
final
void` `
https://developer.android.com/reference/java/lang/Object#wait(long,%20int)(long timeoutMillis, int nanos)
`
Causes the current thread to wait until it is awakened, typically
by being *notified* or *interrupted*, or until a
certain amount of real time has elapsed.
`
final
void` `
https://developer.android.com/reference/java/lang/Object#wait(long)(long timeoutMillis)
`
Causes the current thread to wait until it is awakened, typically
by being *notified* or *interrupted*, or until a
certain amount of real time has elapsed.
`
final
void` `
https://developer.android.com/reference/java/lang/Object#wait()()
`
Causes the current thread to wait until it is awakened, typically
by being *notified* or *interrupted*.
## Constants
### PROPERTY_CROSS_DEVICE_TRUSTED_CERTIFICATES
Added in [version 37.2](https://developer.android.com/topic/libraries/support-library/revisions)
```
public static final String PROPERTY_CROSS_DEVICE_TRUSTED_CERTIFICATES
```
An optional property that applications can define in their manifest's ``
element on the **target device** (the receiver of the request) to specify trusted
signing certificates for cross-device authentication requests.
This property is only relevant for applications that use the cross-device
authentication framework (`https://developer.android.com/reference/android/security/authenticationpolicy/AuthenticationPolicyManager#createCrossDeviceAuthenticationRequest(java.util.UUID,%20java.util.concurrent.Executor,%20android.os.OutcomeReceiver)`).
This property allows the target application to trust cross-device authentication requests
originating from applications signed with different certificates. The value should be a
comma-separated list of SHA-256 fingerprints of the trusted certificates and a maximum
of 50 entries is supported.
Constant Value:
"android.security.authenticationpolicy.CROSS_DEVICE_TRUSTED_CERTIFICATES"
### PROPERTY_CROSS_DEVICE_TRUSTED_PACKAGES
Added in [version 37.2](https://developer.android.com/topic/libraries/support-library/revisions)
```
public static final String PROPERTY_CROSS_DEVICE_TRUSTED_PACKAGES
```
An optional property that applications can define in their manifest's ``
element on the **originating device** (the sender of the request) to specify package
name aliases.
This property is only relevant for applications that use the cross-device
authentication framework (`https://developer.android.com/reference/android/security/authenticationpolicy/AuthenticationPolicyManager#createCrossDeviceAuthenticationRequest(java.util.UUID,%20java.util.concurrent.Executor,%20android.os.OutcomeReceiver)`). For example, an application
should use this property when the application's package name on a wearable, or any other
form factor, is different than the package name on the phone.
Using these aliases does not remove the need for the applications on each device to be
signed with the same certificate unless `https://developer.android.com/reference/android/security/authenticationpolicy/AuthenticationPolicyManager#PROPERTY_CROSS_DEVICE_TRUSTED_CERTIFICATES` is
also used.
Constant Value:
"android.security.authenticationpolicy.CROSS_DEVICE_TRUSTED_PACKAGES"
## Public methods
### createCrossDeviceAuthenticationRequest
Added in [version 37.2](https://developer.android.com/topic/libraries/support-library/revisions)
```
public void createCrossDeviceAuthenticationRequest (UUID associationToken,
Executor callbackExecutor,
OutcomeReceiver callback)
```
Creates a new cross-device authentication request associated with the given
`https://developer.android.com/reference/android/companion/CompanionDeviceManager`'s obfuscated remote device ID. Callers
typically get this ID from a companion application which uses
`https://developer.android.com/reference/android/companion/AssociationInfo#getAssociationToken()` to retrieve it along with other
device information that will be shared with applications.
Returns an opaque token to be passed to the remote device and used as a parameter in
`https://developer.android.com/`
to unpack the data and run authorization checks. In most cases, applications will pass
this token as a parameter to another service that will parse the token to verify the
request before proceeding.
Use `https://developer.android.com/reference/android/security/authenticationpolicy/AuthenticationPolicyManager#PROPERTY_CROSS_DEVICE_TRUSTED_PACKAGES` if the application is known by
another name on the remote device.
Use `https://developer.android.com/reference/android/security/authenticationpolicy/AuthenticationPolicyManager#PROPERTY_CROSS_DEVICE_TRUSTED_CERTIFICATES` if the application is signed
with a different certificate on the remote device.
Using this API requires that the association has been granted a supported trust type via
`https://developer.android.com/reference/android/companion/CompanionDeviceManager#requestDeviceTrustPairing(int,%20android.companion.OutOfBandPairingRequest,%20int[],%20java.util.concurrent.Executor,%20android.companion.CompanionDeviceManager.TrustPairingCallback)` to ensure the
user is informed that cross-device actions are allowed. Untrusted associations will always
fail with an error.
Using this API may also require meeting additional requirements, such as showing an active
notification to the user while the cross-device operation is in progress. Refer to the
documentation of the service that is guarded by this API for details.
| Parameters ||
|---|---|
| `associationToken` | `UUID`: the association token of the remote device where this request will be processed. This value cannot be `null`.
|
| `callbackExecutor` | `Executor`: the executor on which to invoke the callback. This value cannot be `null`. Callback and listener events are dispatched through this `https://developer.android.com/reference/java/util/concurrent/Executor`, providing an easy way to control which thread is used. To dispatch events through the main thread of your application, you can use `https://developer.android.com/reference/android/content/Context#getMainExecutor()`. Otherwise, provide an `https://developer.android.com/reference/java/util/concurrent/Executor` that dispatches to an appropriate thread.
|
| `callback` | `OutcomeReceiver`: the receiver for the encrypted request on success, or an exception on failure. This value cannot be `null`.
|