Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2010 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
Dianne Hackborn | 87bba1e | 2010-02-26 17:25:54 -0800 | [diff] [blame] | 17 | package android.app.admin; |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 18 | |
Jessica Hummel | 9da6039 | 2014-05-21 12:32:57 +0100 | [diff] [blame] | 19 | import android.accounts.AccountManager; |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 20 | import android.annotation.SdkConstant; |
| 21 | import android.annotation.SdkConstant.SdkConstantType; |
Dianne Hackborn | 87bba1e | 2010-02-26 17:25:54 -0800 | [diff] [blame] | 22 | import android.app.Service; |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 23 | import android.content.BroadcastReceiver; |
| 24 | import android.content.ComponentName; |
| 25 | import android.content.Context; |
| 26 | import android.content.Intent; |
Dianne Hackborn | 8ea138c | 2010-01-26 18:01:04 -0800 | [diff] [blame] | 27 | import android.os.Bundle; |
Robin Lee | 3798ed5 | 2015-02-03 17:55:31 +0000 | [diff] [blame] | 28 | import android.security.KeyChain; |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 29 | |
| 30 | /** |
| 31 | * Base class for implementing a device administration component. This |
| 32 | * class provides a convenience for interpreting the raw intent actions |
| 33 | * that are sent by the system. |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 34 | * |
Dianne Hackborn | ef6b22f | 2010-02-16 20:38:49 -0800 | [diff] [blame] | 35 | * <p>The callback methods, like the base |
| 36 | * {@link BroadcastReceiver#onReceive(Context, Intent) BroadcastReceiver.onReceive()} |
| 37 | * method, happen on the main thread of the process. Thus long running |
| 38 | * operations must be done on another thread. Note that because a receiver |
| 39 | * is done once returning from its receive function, such long-running operations |
| 40 | * should probably be done in a {@link Service}. |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 41 | * |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 42 | * <p>When publishing your DeviceAdmin subclass as a receiver, it must |
| 43 | * handle {@link #ACTION_DEVICE_ADMIN_ENABLED} and require the |
| 44 | * {@link android.Manifest.permission#BIND_DEVICE_ADMIN} permission. A typical |
| 45 | * manifest entry would look like:</p> |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 46 | * |
Dianne Hackborn | ab8a8ed | 2010-01-29 19:03:06 -0800 | [diff] [blame] | 47 | * {@sample development/samples/ApiDemos/AndroidManifest.xml device_admin_declaration} |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 48 | * |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 49 | * <p>The meta-data referenced here provides addition information specific |
| 50 | * to the device administrator, as parsed by the {@link DeviceAdminInfo} class. |
| 51 | * A typical file would be:</p> |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 52 | * |
Andrew Stadler | 88209d1 | 2010-02-08 22:59:36 -0800 | [diff] [blame] | 53 | * {@sample development/samples/ApiDemos/res/xml/device_admin_sample.xml meta_data} |
Joe Fernandez | 3aef8e1d | 2011-12-20 10:38:34 -0800 | [diff] [blame] | 54 | * |
| 55 | * <div class="special reference"> |
| 56 | * <h3>Developer Guides</h3> |
| 57 | * <p>For more information about device administration, read the |
| 58 | * <a href="{@docRoot}guide/topics/admin/device-admin.html">Device Administration</a> |
| 59 | * developer guide.</p> |
| 60 | * </div> |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 61 | */ |
Dianne Hackborn | ef6b22f | 2010-02-16 20:38:49 -0800 | [diff] [blame] | 62 | public class DeviceAdminReceiver extends BroadcastReceiver { |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 63 | private static String TAG = "DevicePolicy"; |
Joe Onorato | 43a1765 | 2011-04-06 19:22:23 -0700 | [diff] [blame] | 64 | private static boolean localLOGV = false; |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 65 | |
| 66 | /** |
| 67 | * This is the primary action that a device administrator must implement to be |
| 68 | * allowed to manage a device. This will be set to the receiver |
| 69 | * when the user enables it for administration. You will generally |
Dianne Hackborn | ef6b22f | 2010-02-16 20:38:49 -0800 | [diff] [blame] | 70 | * handle this in {@link DeviceAdminReceiver#onEnabled(Context, Intent)}. To be |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 71 | * supported, the receiver must also require the |
| 72 | * {@link android.Manifest.permission#BIND_DEVICE_ADMIN} permission so |
| 73 | * that other applications can not abuse it. |
| 74 | */ |
| 75 | @SdkConstant(SdkConstantType.BROADCAST_INTENT_ACTION) |
| 76 | public static final String ACTION_DEVICE_ADMIN_ENABLED |
| 77 | = "android.app.action.DEVICE_ADMIN_ENABLED"; |
| 78 | |
| 79 | /** |
Dianne Hackborn | 8ea138c | 2010-01-26 18:01:04 -0800 | [diff] [blame] | 80 | * Action sent to a device administrator when the user has requested to |
| 81 | * disable it, but before this has actually been done. This gives you |
| 82 | * a chance to supply a message to the user about the impact of |
| 83 | * disabling your admin, by setting the extra field |
| 84 | * {@link #EXTRA_DISABLE_WARNING} in the result Intent. If not set, |
| 85 | * no warning will be displayed. If set, the given text will be shown |
| 86 | * to the user before they disable your admin. |
| 87 | */ |
| 88 | @SdkConstant(SdkConstantType.BROADCAST_INTENT_ACTION) |
| 89 | public static final String ACTION_DEVICE_ADMIN_DISABLE_REQUESTED |
| 90 | = "android.app.action.DEVICE_ADMIN_DISABLE_REQUESTED"; |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 91 | |
Dianne Hackborn | 8ea138c | 2010-01-26 18:01:04 -0800 | [diff] [blame] | 92 | /** |
| 93 | * A CharSequence that can be shown to the user informing them of the |
| 94 | * impact of disabling your admin. |
| 95 | * |
| 96 | * @see #ACTION_DEVICE_ADMIN_DISABLE_REQUESTED |
| 97 | */ |
| 98 | public static final String EXTRA_DISABLE_WARNING = "android.app.extra.DISABLE_WARNING"; |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 99 | |
Dianne Hackborn | 8ea138c | 2010-01-26 18:01:04 -0800 | [diff] [blame] | 100 | /** |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 101 | * Action sent to a device administrator when the user has disabled |
| 102 | * it. Upon return, the application no longer has access to the |
| 103 | * protected device policy manager APIs. You will generally |
Dianne Hackborn | ef6b22f | 2010-02-16 20:38:49 -0800 | [diff] [blame] | 104 | * handle this in {@link DeviceAdminReceiver#onDisabled(Context, Intent)}. Note |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 105 | * that this action will be |
| 106 | * sent the receiver regardless of whether it is explicitly listed in |
| 107 | * its intent filter. |
| 108 | */ |
| 109 | @SdkConstant(SdkConstantType.BROADCAST_INTENT_ACTION) |
| 110 | public static final String ACTION_DEVICE_ADMIN_DISABLED |
| 111 | = "android.app.action.DEVICE_ADMIN_DISABLED"; |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 112 | |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 113 | /** |
| 114 | * Action sent to a device administrator when the user has changed the |
| 115 | * password of their device. You can at this point check the characteristics |
Dianne Hackborn | 254cb44 | 2010-01-27 19:23:59 -0800 | [diff] [blame] | 116 | * of the new password with {@link DevicePolicyManager#isActivePasswordSufficient() |
| 117 | * DevicePolicyManager.isActivePasswordSufficient()}. |
| 118 | * You will generally |
Dianne Hackborn | ef6b22f | 2010-02-16 20:38:49 -0800 | [diff] [blame] | 119 | * handle this in {@link DeviceAdminReceiver#onPasswordChanged}. |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 120 | * |
Dianne Hackborn | 8aa2e89 | 2010-01-22 11:31:30 -0800 | [diff] [blame] | 121 | * <p>The calling device admin must have requested |
| 122 | * {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD} to receive |
| 123 | * this broadcast. |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 124 | */ |
| 125 | @SdkConstant(SdkConstantType.BROADCAST_INTENT_ACTION) |
| 126 | public static final String ACTION_PASSWORD_CHANGED |
| 127 | = "android.app.action.ACTION_PASSWORD_CHANGED"; |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 128 | |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 129 | /** |
| 130 | * Action sent to a device administrator when the user has failed at |
| 131 | * attempted to enter the password. You can at this point check the |
| 132 | * number of failed password attempts there have been with |
Dianne Hackborn | 254cb44 | 2010-01-27 19:23:59 -0800 | [diff] [blame] | 133 | * {@link DevicePolicyManager#getCurrentFailedPasswordAttempts |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 134 | * DevicePolicyManager.getCurrentFailedPasswordAttempts()}. You will generally |
Dianne Hackborn | ef6b22f | 2010-02-16 20:38:49 -0800 | [diff] [blame] | 135 | * handle this in {@link DeviceAdminReceiver#onPasswordFailed}. |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 136 | * |
Dianne Hackborn | 8aa2e89 | 2010-01-22 11:31:30 -0800 | [diff] [blame] | 137 | * <p>The calling device admin must have requested |
| 138 | * {@link DeviceAdminInfo#USES_POLICY_WATCH_LOGIN} to receive |
| 139 | * this broadcast. |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 140 | */ |
| 141 | @SdkConstant(SdkConstantType.BROADCAST_INTENT_ACTION) |
| 142 | public static final String ACTION_PASSWORD_FAILED |
| 143 | = "android.app.action.ACTION_PASSWORD_FAILED"; |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 144 | |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 145 | /** |
| 146 | * Action sent to a device administrator when the user has successfully |
| 147 | * entered their password, after failing one or more times. |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 148 | * |
Dianne Hackborn | 8aa2e89 | 2010-01-22 11:31:30 -0800 | [diff] [blame] | 149 | * <p>The calling device admin must have requested |
| 150 | * {@link DeviceAdminInfo#USES_POLICY_WATCH_LOGIN} to receive |
| 151 | * this broadcast. |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 152 | */ |
| 153 | @SdkConstant(SdkConstantType.BROADCAST_INTENT_ACTION) |
| 154 | public static final String ACTION_PASSWORD_SUCCEEDED |
| 155 | = "android.app.action.ACTION_PASSWORD_SUCCEEDED"; |
Jim Miller | a4e28d1 | 2010-11-08 16:15:47 -0800 | [diff] [blame] | 156 | |
| 157 | /** |
| 158 | * Action periodically sent to a device administrator when the device password |
Jim Miller | 6b85768 | 2011-02-16 16:27:41 -0800 | [diff] [blame] | 159 | * is expiring. |
Jim Miller | a4e28d1 | 2010-11-08 16:15:47 -0800 | [diff] [blame] | 160 | * |
| 161 | * <p>The calling device admin must have requested |
| 162 | * {@link DeviceAdminInfo#USES_POLICY_EXPIRE_PASSWORD} to receive |
| 163 | * this broadcast. |
| 164 | */ |
| 165 | @SdkConstant(SdkConstantType.BROADCAST_INTENT_ACTION) |
| 166 | public static final String ACTION_PASSWORD_EXPIRING |
| 167 | = "android.app.action.ACTION_PASSWORD_EXPIRING"; |
| 168 | |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 169 | /** |
Jason Monk | 35c62a4 | 2014-06-17 10:24:47 -0400 | [diff] [blame] | 170 | * Action sent to a device administrator to notify that the device is entering |
Benjamin Franz | 4326114 | 2015-02-11 15:59:44 +0000 | [diff] [blame] | 171 | * lock task mode. The extra {@link #EXTRA_LOCK_TASK_PACKAGE} |
| 172 | * will describe the package using lock task mode. |
Jason Monk | 35c62a4 | 2014-06-17 10:24:47 -0400 | [diff] [blame] | 173 | * |
Jason Monk | 35c62a4 | 2014-06-17 10:24:47 -0400 | [diff] [blame] | 174 | * <p>The calling device admin must be the device owner or profile |
| 175 | * owner to receive this broadcast. |
Benjamin Franz | c70d0e7 | 2015-02-12 16:12:58 +0000 | [diff] [blame] | 176 | * |
| 177 | * @see DevicePolicyManager#isLockTaskPermitted(String) |
Jason Monk | 35c62a4 | 2014-06-17 10:24:47 -0400 | [diff] [blame] | 178 | */ |
| 179 | @SdkConstant(SdkConstantType.BROADCAST_INTENT_ACTION) |
Jason Monk | 48aacba | 2014-08-13 16:29:08 -0400 | [diff] [blame] | 180 | public static final String ACTION_LOCK_TASK_ENTERING |
Jason Monk | 5503a55 | 2014-09-04 14:14:37 -0400 | [diff] [blame] | 181 | = "android.app.action.LOCK_TASK_ENTERING"; |
Jason Monk | 35c62a4 | 2014-06-17 10:24:47 -0400 | [diff] [blame] | 182 | |
| 183 | /** |
Jason Monk | 48aacba | 2014-08-13 16:29:08 -0400 | [diff] [blame] | 184 | * Action sent to a device administrator to notify that the device is exiting |
Benjamin Franz | 4326114 | 2015-02-11 15:59:44 +0000 | [diff] [blame] | 185 | * lock task mode. |
Jason Monk | 35c62a4 | 2014-06-17 10:24:47 -0400 | [diff] [blame] | 186 | * |
Jason Monk | 48aacba | 2014-08-13 16:29:08 -0400 | [diff] [blame] | 187 | * <p>The calling device admin must be the device owner or profile |
| 188 | * owner to receive this broadcast. |
Benjamin Franz | c70d0e7 | 2015-02-12 16:12:58 +0000 | [diff] [blame] | 189 | * |
| 190 | * @see DevicePolicyManager#isLockTaskPermitted(String) |
Jason Monk | 35c62a4 | 2014-06-17 10:24:47 -0400 | [diff] [blame] | 191 | */ |
Jason Monk | 48aacba | 2014-08-13 16:29:08 -0400 | [diff] [blame] | 192 | @SdkConstant(SdkConstantType.BROADCAST_INTENT_ACTION) |
| 193 | public static final String ACTION_LOCK_TASK_EXITING |
Jason Monk | 5503a55 | 2014-09-04 14:14:37 -0400 | [diff] [blame] | 194 | = "android.app.action.LOCK_TASK_EXITING"; |
Jason Monk | 35c62a4 | 2014-06-17 10:24:47 -0400 | [diff] [blame] | 195 | |
| 196 | /** |
Benjamin Franz | c70d0e7 | 2015-02-12 16:12:58 +0000 | [diff] [blame] | 197 | * A string containing the name of the package entering lock task mode. |
Jason Monk | 35c62a4 | 2014-06-17 10:24:47 -0400 | [diff] [blame] | 198 | * |
Benjamin Franz | c70d0e7 | 2015-02-12 16:12:58 +0000 | [diff] [blame] | 199 | * @see #ACTION_LOCK_TASK_ENTERING |
Jason Monk | 35c62a4 | 2014-06-17 10:24:47 -0400 | [diff] [blame] | 200 | */ |
| 201 | public static final String EXTRA_LOCK_TASK_PACKAGE = |
| 202 | "android.app.extra.LOCK_TASK_PACKAGE"; |
| 203 | |
| 204 | /** |
Jessica Hummel | 9da6039 | 2014-05-21 12:32:57 +0100 | [diff] [blame] | 205 | * Broadcast Action: This broadcast is sent to indicate that provisioning of a managed profile |
| 206 | * or managed device has completed successfully. |
Jessica Hummel | f72078b | 2014-03-06 16:13:12 +0000 | [diff] [blame] | 207 | * |
Jessica Hummel | 9da6039 | 2014-05-21 12:32:57 +0100 | [diff] [blame] | 208 | * <p>The broadcast is limited to the profile that will be managed by the application that |
| 209 | * requested provisioning. In the device owner case the profile is the primary user. |
| 210 | * The broadcast will also be limited to the {@link DeviceAdminReceiver} component |
| 211 | * specified in the original intent or NFC bump that started the provisioning process |
Andrew Solovay | 27f5337 | 2015-03-02 16:37:59 -0800 | [diff] [blame] | 212 | * (see {@link DevicePolicyManager#ACTION_PROVISION_MANAGED_PROFILE |
| 213 | * DevicePolicyManager.ACTION_PROVISION_MANAGED_PROFILE}). |
Nicolas Prevot | 07ac20b | 2014-05-27 15:37:45 +0100 | [diff] [blame] | 214 | * |
Sander Alewijnse | 1cc4ecc | 2014-06-23 19:56:52 +0100 | [diff] [blame] | 215 | * <p>A device admin application which listens to this intent can find out if the device was |
| 216 | * provisioned for the device owner or profile owner case by calling respectively |
| 217 | * {@link android.app.admin.DevicePolicyManager#isDeviceOwnerApp} and |
Julia Reynolds | 20118f1 | 2015-02-11 12:34:08 -0500 | [diff] [blame] | 218 | * {@link android.app.admin.DevicePolicyManager#isProfileOwnerApp}. You will generally handle |
| 219 | * this in {@link DeviceAdminReceiver#onProfileProvisioningComplete}. |
Sander Alewijnse | 1cc4ecc | 2014-06-23 19:56:52 +0100 | [diff] [blame] | 220 | * |
Jessica Hummel | f72078b | 2014-03-06 16:13:12 +0000 | [diff] [blame] | 221 | * <p>Input: Nothing.</p> |
| 222 | * <p>Output: Nothing</p> |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 223 | */ |
| 224 | @SdkConstant(SdkConstantType.BROADCAST_INTENT_ACTION) |
Jessica Hummel | f72078b | 2014-03-06 16:13:12 +0000 | [diff] [blame] | 225 | public static final String ACTION_PROFILE_PROVISIONING_COMPLETE = |
Jessica Hummel | 5669216 | 2014-09-10 15:12:11 +0100 | [diff] [blame] | 226 | "android.app.action.PROFILE_PROVISIONING_COMPLETE"; |
| 227 | |
Julia Reynolds | 20118f1 | 2015-02-11 12:34:08 -0500 | [diff] [blame] | 228 | /** |
| 229 | * Broadcast Action: This broadcast is sent to indicate that the system is ready for the device |
| 230 | * initializer to perform user setup tasks. This is only applicable to devices managed by a |
| 231 | * device owner app. |
| 232 | * |
| 233 | * <p>The broadcast will be limited to the {@link DeviceAdminReceiver} component specified in |
| 234 | * the (@link DevicePolicyManager#EXTRA_PROVISIONING_DEVICE_INITIALIZER_COMPONENT_NAME) field |
| 235 | * of the original intent or NFC bump that started the provisioning process. You will generally |
| 236 | * handle this in {@link DeviceAdminReceiver#onReadyForUserInitialization}. |
| 237 | * |
| 238 | * <p>Input: Nothing.</p> |
| 239 | * <p>Output: Nothing</p> |
| 240 | */ |
| 241 | @SdkConstant(SdkConstantType.BROADCAST_INTENT_ACTION) |
| 242 | public static final String ACTION_READY_FOR_USER_INITIALIZATION = |
| 243 | "android.app.action.READY_FOR_USER_INITIALIZATION"; |
| 244 | |
Robin Lee | 3798ed5 | 2015-02-03 17:55:31 +0000 | [diff] [blame] | 245 | /** @hide */ |
| 246 | public static final String ACTION_CHOOSE_PRIVATE_KEY_ALIAS = "android.app.action.CHOOSE_PRIVATE_KEY_ALIAS"; |
| 247 | |
| 248 | /** @hide */ |
| 249 | public static final String EXTRA_CHOOSE_PRIVATE_KEY_SENDER_UID = "android.app.extra.CHOOSE_PRIVATE_KEY_SENDER_UID"; |
| 250 | |
| 251 | /** @hide */ |
| 252 | public static final String EXTRA_CHOOSE_PRIVATE_KEY_HOST = "android.app.extra.CHOOSE_PRIVATE_KEY_HOST"; |
| 253 | |
| 254 | /** @hide */ |
| 255 | public static final String EXTRA_CHOOSE_PRIVATE_KEY_PORT = "android.app.extra.CHOOSE_PRIVATE_KEY_PORT"; |
| 256 | |
| 257 | /** @hide */ |
| 258 | public static final String EXTRA_CHOOSE_PRIVATE_KEY_URL = "android.app.extra.CHOOSE_PRIVATE_KEY_URL"; |
| 259 | |
| 260 | /** @hide */ |
| 261 | public static final String EXTRA_CHOOSE_PRIVATE_KEY_ALIAS = "android.app.extra.CHOOSE_PRIVATE_KEY_ALIAS"; |
| 262 | |
| 263 | /** @hide */ |
| 264 | public static final String EXTRA_CHOOSE_PRIVATE_KEY_RESPONSE = "android.app.extra.CHOOSE_PRIVATE_KEY_RESPONSE"; |
| 265 | |
Julia Reynolds | 20118f1 | 2015-02-11 12:34:08 -0500 | [diff] [blame] | 266 | /** |
Ken Wakasa | f76a50c | 2012-03-09 19:56:35 +0900 | [diff] [blame] | 267 | * Name under which a DevicePolicy component publishes information |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 268 | * about itself. This meta-data must reference an XML resource containing |
Andrew Solovay | 27f5337 | 2015-03-02 16:37:59 -0800 | [diff] [blame] | 269 | * a device-admin tag. |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 270 | */ |
Andrew Solovay | 27f5337 | 2015-03-02 16:37:59 -0800 | [diff] [blame] | 271 | // TO DO: describe syntax. |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 272 | public static final String DEVICE_ADMIN_META_DATA = "android.app.device_admin"; |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 273 | |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 274 | private DevicePolicyManager mManager; |
| 275 | private ComponentName mWho; |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 276 | |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 277 | /** |
| 278 | * Retrieve the DevicePolicyManager interface for this administrator to work |
| 279 | * with the system. |
| 280 | */ |
| 281 | public DevicePolicyManager getManager(Context context) { |
| 282 | if (mManager != null) { |
| 283 | return mManager; |
| 284 | } |
| 285 | mManager = (DevicePolicyManager)context.getSystemService( |
| 286 | Context.DEVICE_POLICY_SERVICE); |
| 287 | return mManager; |
| 288 | } |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 289 | |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 290 | /** |
| 291 | * Retrieve the ComponentName describing who this device administrator is, for |
| 292 | * use in {@link DevicePolicyManager} APIs that require the administrator to |
| 293 | * identify itself. |
| 294 | */ |
| 295 | public ComponentName getWho(Context context) { |
| 296 | if (mWho != null) { |
| 297 | return mWho; |
| 298 | } |
| 299 | mWho = new ComponentName(context, getClass()); |
| 300 | return mWho; |
| 301 | } |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 302 | |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 303 | /** |
| 304 | * Called after the administrator is first enabled, as a result of |
| 305 | * receiving {@link #ACTION_DEVICE_ADMIN_ENABLED}. At this point you |
| 306 | * can use {@link DevicePolicyManager} to set your desired policies. |
Jason Monk | 03978a4 | 2014-06-10 15:05:30 -0400 | [diff] [blame] | 307 | * |
| 308 | * <p> If the admin is activated by a device owner, then the intent |
| 309 | * may contain private extras that are relevant to user setup. |
| 310 | * {@see DevicePolicyManager#createAndInitializeUser(ComponentName, String, String, |
| 311 | * ComponentName, Intent)} |
| 312 | * |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 313 | * @param context The running context as per {@link #onReceive}. |
| 314 | * @param intent The received intent as per {@link #onReceive}. |
| 315 | */ |
| 316 | public void onEnabled(Context context, Intent intent) { |
| 317 | } |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 318 | |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 319 | /** |
Dianne Hackborn | 8ea138c | 2010-01-26 18:01:04 -0800 | [diff] [blame] | 320 | * Called when the user has asked to disable the administrator, as a result of |
| 321 | * receiving {@link #ACTION_DEVICE_ADMIN_DISABLE_REQUESTED}, giving you |
| 322 | * a chance to present a warning message to them. The message is returned |
| 323 | * as the result; if null is returned (the default implementation), no |
| 324 | * message will be displayed. |
| 325 | * @param context The running context as per {@link #onReceive}. |
| 326 | * @param intent The received intent as per {@link #onReceive}. |
| 327 | * @return Return the warning message to display to the user before |
| 328 | * being disabled; if null is returned, no message is displayed. |
| 329 | */ |
| 330 | public CharSequence onDisableRequested(Context context, Intent intent) { |
| 331 | return null; |
| 332 | } |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 333 | |
Dianne Hackborn | 8ea138c | 2010-01-26 18:01:04 -0800 | [diff] [blame] | 334 | /** |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 335 | * Called prior to the administrator being disabled, as a result of |
| 336 | * receiving {@link #ACTION_DEVICE_ADMIN_DISABLED}. Upon return, you |
| 337 | * can no longer use the protected parts of the {@link DevicePolicyManager} |
| 338 | * API. |
| 339 | * @param context The running context as per {@link #onReceive}. |
| 340 | * @param intent The received intent as per {@link #onReceive}. |
| 341 | */ |
| 342 | public void onDisabled(Context context, Intent intent) { |
| 343 | } |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 344 | |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 345 | /** |
| 346 | * Called after the user has changed their password, as a result of |
| 347 | * receiving {@link #ACTION_PASSWORD_CHANGED}. At this point you |
| 348 | * can use {@link DevicePolicyManager#getCurrentFailedPasswordAttempts() |
| 349 | * DevicePolicyManager.getCurrentFailedPasswordAttempts()} |
| 350 | * to retrieve the active password characteristics. |
| 351 | * @param context The running context as per {@link #onReceive}. |
| 352 | * @param intent The received intent as per {@link #onReceive}. |
| 353 | */ |
| 354 | public void onPasswordChanged(Context context, Intent intent) { |
| 355 | } |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 356 | |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 357 | /** |
| 358 | * Called after the user has failed at entering their current password, as a result of |
| 359 | * receiving {@link #ACTION_PASSWORD_FAILED}. At this point you |
| 360 | * can use {@link DevicePolicyManager} to retrieve the number of failed |
| 361 | * password attempts. |
| 362 | * @param context The running context as per {@link #onReceive}. |
| 363 | * @param intent The received intent as per {@link #onReceive}. |
| 364 | */ |
| 365 | public void onPasswordFailed(Context context, Intent intent) { |
| 366 | } |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 367 | |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 368 | /** |
| 369 | * Called after the user has succeeded at entering their current password, |
| 370 | * as a result of receiving {@link #ACTION_PASSWORD_SUCCEEDED}. This will |
| 371 | * only be received the first time they succeed after having previously |
| 372 | * failed. |
| 373 | * @param context The running context as per {@link #onReceive}. |
| 374 | * @param intent The received intent as per {@link #onReceive}. |
| 375 | */ |
| 376 | public void onPasswordSucceeded(Context context, Intent intent) { |
| 377 | } |
Jim Miller | a4e28d1 | 2010-11-08 16:15:47 -0800 | [diff] [blame] | 378 | |
| 379 | /** |
| 380 | * Called periodically when the password is about to expire or has expired. It will typically |
Jim Miller | 6b85768 | 2011-02-16 16:27:41 -0800 | [diff] [blame] | 381 | * be called at these times: on device boot, once per day before the password expires, |
| 382 | * and at the time when the password expires. |
Jim Miller | a4e28d1 | 2010-11-08 16:15:47 -0800 | [diff] [blame] | 383 | * |
| 384 | * <p>If the password is not updated by the user, this method will continue to be called |
| 385 | * once per day until the password is changed or the device admin disables password expiration. |
| 386 | * |
| 387 | * <p>The admin will typically post a notification requesting the user to change their password |
| 388 | * in response to this call. The actual password expiration time can be obtained by calling |
| 389 | * {@link DevicePolicyManager#getPasswordExpiration(ComponentName) } |
| 390 | * |
| 391 | * <p>The admin should be sure to take down any notifications it posted in response to this call |
| 392 | * when it receives {@link DeviceAdminReceiver#onPasswordChanged(Context, Intent) }. |
| 393 | * |
| 394 | * @param context The running context as per {@link #onReceive}. |
| 395 | * @param intent The received intent as per {@link #onReceive}. |
| 396 | */ |
| 397 | public void onPasswordExpiring(Context context, Intent intent) { |
| 398 | } |
| 399 | |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 400 | /** |
Jessica Hummel | 9da6039 | 2014-05-21 12:32:57 +0100 | [diff] [blame] | 401 | * Called when provisioning of a managed profile or managed device has completed successfully. |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 402 | * |
Julia Reynolds | 20118f1 | 2015-02-11 12:34:08 -0500 | [diff] [blame] | 403 | * <p> As a prerequisite for the execution of this callback the {@link DeviceAdminReceiver} has |
Jessica Hummel | 9da6039 | 2014-05-21 12:32:57 +0100 | [diff] [blame] | 404 | * to declare an intent filter for {@link #ACTION_PROFILE_PROVISIONING_COMPLETE}. |
| 405 | * Its component must also be specified in the {@link DevicePolicyManager#EXTRA_DEVICE_ADMIN} |
| 406 | * of the {@link DevicePolicyManager#ACTION_PROVISION_MANAGED_PROFILE} intent that started the |
| 407 | * managed provisioning. |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 408 | * |
Julia Reynolds | 20118f1 | 2015-02-11 12:34:08 -0500 | [diff] [blame] | 409 | * <p>When provisioning of a managed profile is complete, the managed profile is hidden until |
| 410 | * the profile owner calls {DevicePolicyManager#setProfileEnabled(ComponentName admin)}. |
| 411 | * Typically a profile owner will enable the profile when it has finished any additional setup |
| 412 | * such as adding an account by using the {@link AccountManager} and calling apis to bring the |
| 413 | * profile into the desired state. |
Jessica Hummel | 9da6039 | 2014-05-21 12:32:57 +0100 | [diff] [blame] | 414 | * |
| 415 | * <p> Note that provisioning completes without waiting for any server interactions, so the |
Julia Reynolds | 20118f1 | 2015-02-11 12:34:08 -0500 | [diff] [blame] | 416 | * profile owner needs to wait for data to be available if required (e.g. android device ids or |
Jessica Hummel | 9da6039 | 2014-05-21 12:32:57 +0100 | [diff] [blame] | 417 | * other data that is set as a result of server interactions). |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 418 | * |
| 419 | * @param context The running context as per {@link #onReceive}. |
| 420 | * @param intent The received intent as per {@link #onReceive}. |
| 421 | */ |
| 422 | public void onProfileProvisioningComplete(Context context, Intent intent) { |
| 423 | } |
| 424 | |
| 425 | /** |
Julia Reynolds | 20118f1 | 2015-02-11 12:34:08 -0500 | [diff] [blame] | 426 | * Called during provisioning of a managed device to allow the device initializer to perform |
| 427 | * user setup steps. Only device initializers should override this method. |
| 428 | * |
| 429 | * <p> Called when the DeviceAdminReceiver receives a |
| 430 | * {@link #ACTION_READY_FOR_USER_INITIALIZATION} broadcast. As a prerequisite for the execution |
| 431 | * of this callback the {@link DeviceAdminReceiver} has |
| 432 | * to declare an intent filter for {@link #ACTION_READY_FOR_USER_INITIALIZATION}. Only the |
| 433 | * component specified in the |
| 434 | * {@link DevicePolicyManager#EXTRA_PROVISIONING_DEVICE_INITIALIZER_COMPONENT_NAME} field of the |
| 435 | * original intent or NFC bump that started the provisioning process will receive this callback. |
| 436 | * |
| 437 | * <p>It is not assumed that the device initializer is finished when it returns from |
| 438 | * this call, as it may do additional setup asynchronously. The device initializer must call |
| 439 | * {DevicePolicyManager#setUserEnabled(ComponentName admin)} when it has finished any additional |
| 440 | * setup (such as adding an account by using the {@link AccountManager}) in order for the user |
| 441 | * to be functional. |
| 442 | * |
| 443 | * @param context The running context as per {@link #onReceive}. |
| 444 | * @param intent The received intent as per {@link #onReceive}. |
| 445 | */ |
| 446 | public void onReadyForUserInitialization(Context context, Intent intent) { |
| 447 | } |
| 448 | |
| 449 | /** |
Benjamin Franz | 4326114 | 2015-02-11 15:59:44 +0000 | [diff] [blame] | 450 | * Called when a device is entering lock task mode. |
Jason Monk | 35c62a4 | 2014-06-17 10:24:47 -0400 | [diff] [blame] | 451 | * |
| 452 | * @param context The running context as per {@link #onReceive}. |
| 453 | * @param intent The received intent as per {@link #onReceive}. |
Jason Monk | 35c62a4 | 2014-06-17 10:24:47 -0400 | [diff] [blame] | 454 | * @param pkg If entering, the authorized package using lock task mode, otherwise null. |
| 455 | */ |
Jason Monk | 48aacba | 2014-08-13 16:29:08 -0400 | [diff] [blame] | 456 | public void onLockTaskModeEntering(Context context, Intent intent, String pkg) { |
| 457 | } |
| 458 | |
| 459 | /** |
Benjamin Franz | 4326114 | 2015-02-11 15:59:44 +0000 | [diff] [blame] | 460 | * Called when a device is exiting lock task mode. |
Jason Monk | 48aacba | 2014-08-13 16:29:08 -0400 | [diff] [blame] | 461 | * |
| 462 | * @param context The running context as per {@link #onReceive}. |
| 463 | * @param intent The received intent as per {@link #onReceive}. |
| 464 | */ |
| 465 | public void onLockTaskModeExiting(Context context, Intent intent) { |
Jason Monk | 35c62a4 | 2014-06-17 10:24:47 -0400 | [diff] [blame] | 466 | } |
| 467 | |
| 468 | /** |
Robin Lee | 3798ed5 | 2015-02-03 17:55:31 +0000 | [diff] [blame] | 469 | * Allows this receiver to select the alias for a private key and certificate pair for |
| 470 | * authentication. If this method returns null, the default {@link android.app.Activity} will be |
| 471 | * shown that lets the user pick a private key and certificate pair. |
| 472 | * |
| 473 | * @param context The running context as per {@link #onReceive}. |
| 474 | * @param intent The received intent as per {@link #onReceive}. |
| 475 | * @param uid The uid asking for the private key and certificate pair. |
| 476 | * @param host The authentication host, may be null. |
| 477 | * @param port The authentication port, or -1. |
| 478 | * @param url The URL to authenticate, may be null. |
| 479 | * @param alias The alias preselected by the client, or null. |
| 480 | * @return The private key alias to return and grant access to. |
| 481 | * @see KeyChain#choosePrivateKeyAlias |
| 482 | */ |
Robin Lee | abf3570 | 2015-02-17 14:12:48 +0000 | [diff] [blame] | 483 | public String onChoosePrivateKeyAlias(Context context, Intent intent, int uid, String host, |
Robin Lee | 3798ed5 | 2015-02-03 17:55:31 +0000 | [diff] [blame] | 484 | int port, String url, String alias) { |
| 485 | return null; |
| 486 | } |
| 487 | |
| 488 | /** |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 489 | * Intercept standard device administrator broadcasts. Implementations |
| 490 | * should not override this method; it is better to implement the |
| 491 | * convenience callbacks for each action. |
| 492 | */ |
| 493 | @Override |
| 494 | public void onReceive(Context context, Intent intent) { |
| 495 | String action = intent.getAction(); |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 496 | |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 497 | if (ACTION_PASSWORD_CHANGED.equals(action)) { |
| 498 | onPasswordChanged(context, intent); |
| 499 | } else if (ACTION_PASSWORD_FAILED.equals(action)) { |
| 500 | onPasswordFailed(context, intent); |
| 501 | } else if (ACTION_PASSWORD_SUCCEEDED.equals(action)) { |
| 502 | onPasswordSucceeded(context, intent); |
| 503 | } else if (ACTION_DEVICE_ADMIN_ENABLED.equals(action)) { |
| 504 | onEnabled(context, intent); |
Dianne Hackborn | 8ea138c | 2010-01-26 18:01:04 -0800 | [diff] [blame] | 505 | } else if (ACTION_DEVICE_ADMIN_DISABLE_REQUESTED.equals(action)) { |
| 506 | CharSequence res = onDisableRequested(context, intent); |
| 507 | if (res != null) { |
| 508 | Bundle extras = getResultExtras(true); |
| 509 | extras.putCharSequence(EXTRA_DISABLE_WARNING, res); |
| 510 | } |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 511 | } else if (ACTION_DEVICE_ADMIN_DISABLED.equals(action)) { |
| 512 | onDisabled(context, intent); |
Jim Miller | a4e28d1 | 2010-11-08 16:15:47 -0800 | [diff] [blame] | 513 | } else if (ACTION_PASSWORD_EXPIRING.equals(action)) { |
| 514 | onPasswordExpiring(context, intent); |
Jessica Hummel | 8cdb6fc | 2014-03-03 14:14:51 +0000 | [diff] [blame] | 515 | } else if (ACTION_PROFILE_PROVISIONING_COMPLETE.equals(action)) { |
| 516 | onProfileProvisioningComplete(context, intent); |
Robin Lee | 3798ed5 | 2015-02-03 17:55:31 +0000 | [diff] [blame] | 517 | } else if (ACTION_CHOOSE_PRIVATE_KEY_ALIAS.equals(action)) { |
Robin Lee | abf3570 | 2015-02-17 14:12:48 +0000 | [diff] [blame] | 518 | int uid = intent.getIntExtra(EXTRA_CHOOSE_PRIVATE_KEY_SENDER_UID, -1); |
Robin Lee | 3798ed5 | 2015-02-03 17:55:31 +0000 | [diff] [blame] | 519 | String host = intent.getStringExtra(EXTRA_CHOOSE_PRIVATE_KEY_HOST); |
| 520 | int port = intent.getIntExtra(EXTRA_CHOOSE_PRIVATE_KEY_PORT, -1); |
| 521 | String url = intent.getStringExtra(EXTRA_CHOOSE_PRIVATE_KEY_URL); |
| 522 | String alias = intent.getStringExtra(EXTRA_CHOOSE_PRIVATE_KEY_ALIAS); |
| 523 | String chosenAlias = onChoosePrivateKeyAlias(context, intent, uid, host, port, url, |
| 524 | alias); |
| 525 | setResultData(chosenAlias); |
Jason Monk | 48aacba | 2014-08-13 16:29:08 -0400 | [diff] [blame] | 526 | } else if (ACTION_LOCK_TASK_ENTERING.equals(action)) { |
Jason Monk | 35c62a4 | 2014-06-17 10:24:47 -0400 | [diff] [blame] | 527 | String pkg = intent.getStringExtra(EXTRA_LOCK_TASK_PACKAGE); |
Jason Monk | 48aacba | 2014-08-13 16:29:08 -0400 | [diff] [blame] | 528 | onLockTaskModeEntering(context, intent, pkg); |
| 529 | } else if (ACTION_LOCK_TASK_EXITING.equals(action)) { |
| 530 | onLockTaskModeExiting(context, intent); |
Julia Reynolds | 20118f1 | 2015-02-11 12:34:08 -0500 | [diff] [blame] | 531 | } else if (ACTION_READY_FOR_USER_INITIALIZATION.equals(action)) { |
| 532 | onReadyForUserInitialization(context, intent); |
Dianne Hackborn | d684784 | 2010-01-12 18:14:19 -0800 | [diff] [blame] | 533 | } |
| 534 | } |
| 535 | } |