diff --git a/core/res/res/values/config.xml b/core/res/res/values/config.xml
index e7811df1041af..997f995dcf525 100755
--- a/core/res/res/values/config.xml
+++ b/core/res/res/values/config.xml
@@ -2196,6 +2196,9 @@
     <!-- Keyguard component -->
     <string name="config_keyguardComponent" translatable="false">com.android.systemui/com.android.systemui.keyguard.KeyguardService</string>
 
+    <!-- For performance and storage reasons, limit the number of fingerprints per user -->
+    <integer name="config_fingerprintMaxTemplatesPerUser">5</integer>
+
     <!-- This config is used to force VoiceInteractionService to start on certain low ram devices.
          It declares the package name of VoiceInteractionService that should be started. -->
     <string translatable="false" name="config_forceVoiceInteractionServicePackage"></string>
diff --git a/core/res/res/values/symbols.xml b/core/res/res/values/symbols.xml
index 45e5d17b32187..ede843ec90b6b 100755
--- a/core/res/res/values/symbols.xml
+++ b/core/res/res/values/symbols.xml
@@ -2125,6 +2125,9 @@
   <java-symbol type="string" name="fingerprint_error_lockout" />
   <java-symbol type="string" name="fingerprint_name_template" />
 
+  <!-- Fingerprint config -->
+  <java-symbol type="integer" name="config_fingerprintMaxTemplatesPerUser"/>
+
   <!-- From various Material changes -->
   <java-symbol type="attr" name="titleTextAppearance" />
   <java-symbol type="attr" name="subtitleTextAppearance" />
diff --git a/services/core/java/com/android/server/fingerprint/FingerprintService.java b/services/core/java/com/android/server/fingerprint/FingerprintService.java
index 7f0be5766d1a7..c52a1c1ce6db8 100644
--- a/services/core/java/com/android/server/fingerprint/FingerprintService.java
+++ b/services/core/java/com/android/server/fingerprint/FingerprintService.java
@@ -33,6 +33,7 @@ import android.os.MessageQueue;
 import android.os.RemoteException;
 import android.os.SELinux;
 import android.os.ServiceManager;
+import android.os.UserHandle;
 import android.util.Slog;
 
 import com.android.server.SystemService;
@@ -389,12 +390,12 @@ public class FingerprintService extends SystemService implements IBinder.DeathRe
         }
     }
 
-    public List<Fingerprint> getEnrolledFingerprints(int groupId) {
-        return mFingerprintUtils.getFingerprintsForUser(mContext, groupId);
+    public List<Fingerprint> getEnrolledFingerprints(int userId) {
+        return mFingerprintUtils.getFingerprintsForUser(mContext, userId);
     }
 
-    public boolean hasEnrolledFingerprints(int groupId) {
-        return mFingerprintUtils.getFingerprintsForUser(mContext, groupId).size() > 0;
+    public boolean hasEnrolledFingerprints(int userId) {
+        return mFingerprintUtils.getFingerprintsForUser(mContext, userId).size() > 0;
     }
 
     boolean hasPermission(String permission) {
@@ -598,6 +599,15 @@ public class FingerprintService extends SystemService implements IBinder.DeathRe
         public void enroll(final IBinder token, final byte[] cryptoToken, final int groupId,
                 final IFingerprintServiceReceiver receiver, final int flags) {
             checkPermission(MANAGE_FINGERPRINT);
+            final int limit =  mContext.getResources().getInteger(
+                    com.android.internal.R.integer.config_fingerprintMaxTemplatesPerUser);
+            final int callingUid = Binder.getCallingUid();
+            final int userId = UserHandle.getUserId(callingUid);
+            final int enrolled = FingerprintService.this.getEnrolledFingerprints(userId).size();
+            if (enrolled >= limit) {
+                Slog.w(TAG, "Too many fingerprints registered");
+                return;
+            }
             final byte [] cryptoClone = Arrays.copyOf(cryptoToken, cryptoToken.length);
 
             final boolean restricted = isRestricted();
@@ -689,11 +699,11 @@ public class FingerprintService extends SystemService implements IBinder.DeathRe
         }
 
         @Override // Binder call
-        public List<Fingerprint> getEnrolledFingerprints(int groupId, String opPackageName) {
+        public List<Fingerprint> getEnrolledFingerprints(int userId, String opPackageName) {
             if (!canUseFingerprint(opPackageName)) {
                 return Collections.emptyList();
             }
-            return FingerprintService.this.getEnrolledFingerprints(groupId);
+            return FingerprintService.this.getEnrolledFingerprints(userId);
         }
 
         @Override // Binder call