Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

3/n: Remove challenge from verifyCredential

Browse Source 
Decouples the remainder of challenges from LockSettingsService.
Clients that require Gatekeeper HATs that wrap challenges should
request the Gatekeeper Password, then request LockSettingsService
to verify(GatekeeperPassword, Challenge). If the challenge is
biometric-related, it must be generated after LockSettingsService
completes verifyCredential, since LockSettingsService internally
does generateChallenge/resetLockout/revokeChallenge.

Bug: 161765592
Test: CtsVerifier biometric portion
Test: Reset fingerprint/face lockout
Test: atest com.android.server.locksettings

Change-Id: Icb384194ce5007b264068e697113d55cbf94945b
This commit is contained in:
Kevin Chyn
2020-07-24 00:24:11 -07:00
parent 6e6a735e65
commit cdf4b2868a
11 changed files with 87 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
core/java/android/hardware/face/FaceManager.java
View File

@@ -1073,12 +1073,12 @@ public class FaceManager implements BiometricAuthenticator, BiometricFaceConstan
/**
* @hide
*/
public abstract static class GenerateChallengeCallback {
public abstract void onGenerateChallengeResult(long challenge);
public interface GenerateChallengeCallback {
void onGenerateChallengeResult(long challenge);
}
private abstract static class InternalGenerateChallengeCallback
extends GenerateChallengeCallback {}
implements GenerateChallengeCallback {}
private class OnEnrollCancelListener implements OnCancelListener {
@Override

4
core/java/com/android/internal/widget/ILockSettings.aidl
View File

@@ -47,8 +47,8 @@ interface ILockSettings {
void resetKeyStore(int userId);
VerifyCredentialResponse checkCredential(in LockscreenCredential credential, int userId,
in ICheckCredentialProgressCallback progressCallback);
VerifyCredentialResponse verifyCredential(in LockscreenCredential credential, long challenge, int userId, int flags);
VerifyCredentialResponse verifyTiedProfileChallenge(in LockscreenCredential credential, long challenge, int userId, int flags);
VerifyCredentialResponse verifyCredential(in LockscreenCredential credential, int userId, int flags);
VerifyCredentialResponse verifyTiedProfileChallenge(in LockscreenCredential credential, int userId, int flags);
VerifyCredentialResponse verifyGatekeeperPassword(in byte[] gatekeeperPassword, long challenge, int userId);
boolean checkVoldPassword(int userId);
int getCredentialType(int userId);

8
core/java/com/android/internal/widget/LockPatternChecker.java
View File

@@ -54,14 +54,12 @@ public final class LockPatternChecker {
*
* @param utils The LockPatternUtils instance to use.
* @param credential The credential to check.
* @param challenge The challenge to verify against the credential.
* @param userId The user to check against the credential.
* @param flags See {@link LockPatternUtils.VerifyFlag}
* @param callback The callback to be invoked with the verification result.
*/
public static AsyncTask<?, ?, ?> verifyCredential(final LockPatternUtils utils,
final LockscreenCredential credential,
final long challenge,
final int userId,
final @LockPatternUtils.VerifyFlag int flags,
final OnVerifyCallback callback) {
@@ -71,7 +69,7 @@ public final class LockPatternChecker {
new AsyncTask<Void, Void, VerifyCredentialResponse>() {
@Override
protected VerifyCredentialResponse doInBackground(Void... args) {
return utils.verifyCredential(credentialCopy, challenge, userId, flags);
return utils.verifyCredential(credentialCopy, userId, flags);
}
@Override
@@ -138,14 +136,12 @@ public final class LockPatternChecker {
*
* @param utils The LockPatternUtils instance to use.
* @param credential The credential to check.
* @param challenge The challenge to verify against the credential.
* @param userId The user to check against the credential.
* @param flags See {@link LockPatternUtils.VerifyFlag}
* @param callback The callback to be invoked with the verification result.
*/
public static AsyncTask<?, ?, ?> verifyTiedProfileChallenge(final LockPatternUtils utils,
final LockscreenCredential credential,
final long challenge,
final int userId,
final @LockPatternUtils.VerifyFlag int flags,
final OnVerifyCallback callback) {
@@ -155,7 +151,7 @@ public final class LockPatternChecker {
new AsyncTask<Void, Void, VerifyCredentialResponse>() {
@Override
protected VerifyCredentialResponse doInBackground(Void... args) {
return utils.verifyTiedProfileChallenge(credentialCopy, challenge, userId, flags);
return utils.verifyTiedProfileChallenge(credentialCopy, userId, flags);
}
@Override

15
core/java/com/android/internal/widget/LockPatternUtils.java
View File

@@ -386,18 +386,17 @@ public class LockPatternUtils {
* If credential matches, return an opaque attestation that the challenge was verified.
*
* @param credential The credential to check.
* @param challenge The challenge to verify against the credential
* @param userId The user whose credential is being verified
* @param flags See {@link VerifyFlag}
* @throws IllegalStateException if called on the main thread.
*/
@NonNull
public VerifyCredentialResponse verifyCredential(@NonNull LockscreenCredential credential,
long challenge, int userId, @VerifyFlag int flags) {
int userId, @VerifyFlag int flags) {
throwIfCalledOnMainThread();
try {
final VerifyCredentialResponse response = getLockSettings().verifyCredential(
credential, challenge, userId, flags);
credential, userId, flags);
if (response == null) {
return VerifyCredentialResponse.ERROR;
} else {
@@ -411,8 +410,8 @@ public class LockPatternUtils {
/**
* With the Gatekeeper Password returned via {@link #verifyCredential(LockscreenCredential,
* long, int, boolean)}, request Gatekeeper to create a HardwareAuthToken wrapping the
* given challenge.
* int, int)}, request Gatekeeper to create a HardwareAuthToken wrapping the given
* challenge.
*/
@NonNull
public VerifyCredentialResponse verifyGatekeeperPassword(@NonNull byte[] gatekeeperPassword,
@@ -470,7 +469,6 @@ public class LockPatternUtils {
* verified.
*
* @param credential The parent user's credential to check.
* @param challenge The challenge to verify against the credential
* @return the attestation that the challenge was verified, or null
* @param userId The managed profile user id
* @param flags See {@link VerifyFlag}
@@ -478,12 +476,11 @@ public class LockPatternUtils {
*/
@NonNull
public VerifyCredentialResponse verifyTiedProfileChallenge(
@NonNull LockscreenCredential credential,
long challenge, int userId, @VerifyFlag int flags) {
@NonNull LockscreenCredential credential, int userId, @VerifyFlag int flags) {
throwIfCalledOnMainThread();
try {
final VerifyCredentialResponse response = getLockSettings()
.verifyTiedProfileChallenge(credential, challenge, userId, flags);
.verifyTiedProfileChallenge(credential, userId, flags);
if (response == null) {
return VerifyCredentialResponse.ERROR;
} else {

6
packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialPasswordView.java
View File

@@ -28,6 +28,7 @@ import android.widget.ImeAwareEditText;
import android.widget.TextView;
import com.android.internal.widget.LockPatternChecker;
import com.android.internal.widget.LockPatternUtils;
import com.android.internal.widget.LockscreenCredential;
import com.android.internal.widget.VerifyCredentialResponse;
import com.android.systemui.R;
@@ -106,8 +107,11 @@ public class AuthCredentialPasswordView extends AuthCredentialView
return;
}
// Request LockSettingsService to return the Gatekeeper Password in the
// VerifyCredentialResponse so that we can request a Gatekeeper HAT with the
// Gatekeeper Password and operationId.
mPendingLockCheck = LockPatternChecker.verifyCredential(mLockPatternUtils,
password, mOperationId, mEffectiveUserId, 0 /* flags */,
password, mEffectiveUserId, LockPatternUtils.VERIFY_FLAG_RETURN_GK_PW,
this::onCredentialVerified);
}
}

6
packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialPatternView.java
View File

@@ -68,12 +68,14 @@ public class AuthCredentialPatternView extends AuthCredentialView {
}
try (LockscreenCredential credential = LockscreenCredential.createPattern(pattern)) {
// Request LockSettingsService to return the Gatekeeper Password in the
// VerifyCredentialResponse so that we can request a Gatekeeper HAT with the
// Gatekeeper Password and operationId.
mPendingLockCheck = LockPatternChecker.verifyCredential(
mLockPatternUtils,
credential,
mOperationId,
mEffectiveUserId,
0 /* flags */,
LockPatternUtils.VERIFY_FLAG_RETURN_GK_PW,
this::onPatternVerified);
}
}

9
packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialView.java
View File

@@ -288,7 +288,14 @@ public abstract class AuthCredentialView extends LinearLayout {
if (response.isMatched()) {
mClearErrorRunnable.run();
mLockPatternUtils.userPresent(mEffectiveUserId);
mCallback.onCredentialMatched(response.getGatekeeperHAT());
// The response passed into this method contains the Gatekeeper Password. We still
// have to request Gatekeeper to create a Hardware Auth Token with the
// Gatekeeper Password and Challenge (keystore operationId in this case)
final VerifyCredentialResponse gkResponse = mLockPatternUtils.verifyGatekeeperPassword(
response.getGatekeeperPw(), mOperationId, mEffectiveUserId);
mCallback.onCredentialMatched(gkResponse.getGatekeeperHAT());
} else {
if (timeoutMs > 0) {
mHandler.removeCallbacks(mClearErrorRunnable);

33
services/core/java/com/android/server/locksettings/LockSettingsService.java
View File

@@ -187,6 +187,9 @@ public class LockSettingsService extends ILockSettings.Stub {
private static final String SYNTHETIC_PASSWORD_UPDATE_TIME_KEY = "sp-handle-ts";
private static final String USER_SERIAL_NUMBER_KEY = "serial-number";
// TODO (b/145978626) LockSettingsService no longer accepts challenges in the verifyCredential
// paths. These are temporarily left around to ensure that resetLockout works. It will be
// removed once resetLockout is compartmentalized.
// No challenge provided
private static final int CHALLENGE_NONE = 0;
// Challenge was provided from the external caller (non-LockSettingsService)
@@ -1609,8 +1612,8 @@ public class LockSettingsService extends ILockSettings.Stub {
// Verify the parent credential again, to make sure we have a fresh enough
// auth token such that getDecryptedPasswordForTiedProfile() inside
// setLockCredentialInternal() can function correctly.
verifyCredential(savedCredential, /* challenge */ 0,
mUserManager.getProfileParent(userId).id, 0 /* flags */);
verifyCredential(savedCredential, mUserManager.getProfileParent(userId).id,
0 /* flags */);
savedCredential.zeroize();
savedCredential = LockscreenCredential.createNone();
}
@@ -1969,7 +1972,7 @@ public class LockSettingsService extends ILockSettings.Stub {
ICheckCredentialProgressCallback progressCallback) {
checkPasswordReadPermission(userId);
try {
return doVerifyCredential(credential, CHALLENGE_NONE, 0, userId, progressCallback,
return doVerifyCredential(credential, CHALLENGE_NONE, 0L, userId, progressCallback,
0 /* flags */);
} finally {
scheduleGc();
@@ -1979,21 +1982,11 @@ public class LockSettingsService extends ILockSettings.Stub {
@Override
@Nullable
public VerifyCredentialResponse verifyCredential(LockscreenCredential credential,
long challenge, int userId, @LockPatternUtils.VerifyFlag int flags) {
int userId, int flags) {
checkPasswordReadPermission(userId);
@ChallengeType int challengeType = CHALLENGE_FROM_CALLER;
if (challenge == 0) {
Slog.w(TAG, "VerifyCredential called with challenge=0");
challengeType = CHALLENGE_NONE;
}
if (challenge != 0 && ((flags & VERIFY_FLAG_RETURN_GK_PW) != 0)) {
// Caller requests Gatekeeper Password to be returned. Challenge is a no-op here, since
// its only used when Gatekeeper verifies the SP.
Slog.w(TAG, "Challenge will not be used");
}
try {
return doVerifyCredential(credential, challengeType, challenge, userId,
return doVerifyCredential(credential, CHALLENGE_NONE, 0L, userId,
null /* progressCallback */, flags);
} finally {
scheduleGc();
@@ -2083,7 +2076,7 @@ public class LockSettingsService extends ILockSettings.Stub {
@Override
public VerifyCredentialResponse verifyTiedProfileChallenge(LockscreenCredential credential,
long challenge, int userId, @LockPatternUtils.VerifyFlag int flags) {
int userId, @LockPatternUtils.VerifyFlag int flags) {
checkPasswordReadPermission(userId);
if (!isManagedProfileWithUnifiedLock(userId)) {
throw new IllegalArgumentException("User id must be managed profile with unified lock");
@@ -2092,8 +2085,8 @@ public class LockSettingsService extends ILockSettings.Stub {
// Unlock parent by using parent's challenge
final VerifyCredentialResponse parentResponse = doVerifyCredential(
credential,
CHALLENGE_FROM_CALLER,
challenge,
CHALLENGE_NONE,
0L,
parentProfileId,
null /* progressCallback */,
flags);
@@ -2105,8 +2098,8 @@ public class LockSettingsService extends ILockSettings.Stub {
try {
// Unlock work profile, and work profile with unified lock must use password only
return doVerifyCredential(getDecryptedPasswordForTiedProfile(userId),
CHALLENGE_FROM_CALLER,
challenge,
CHALLENGE_NONE,
0L,
userId, null /* progressCallback */,
flags);
} catch (UnrecoverableKeyException | InvalidKeyException | KeyStoreException

21
services/tests/servicestests/src/com/android/server/locksettings/LockSettingsServiceTests.java
View File

@@ -129,7 +129,7 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests {
mGateKeeperService.clearAuthToken(TURNED_OFF_PROFILE_USER_ID);
// verify credential
assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential(
firstUnifiedPassword, 0, PRIMARY_USER_ID)
firstUnifiedPassword, PRIMARY_USER_ID, 0 /* flags */)
.getResponseCode());
// Verify that we have a new auth token for the profile
@@ -186,13 +186,13 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests {
mGateKeeperService.clearAuthToken(MANAGED_PROFILE_USER_ID);
// verify primary credential
assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential(
primaryPassword, 0, PRIMARY_USER_ID)
primaryPassword, PRIMARY_USER_ID, 0 /* flags */)
.getResponseCode());
assertNull(mGateKeeperService.getAuthToken(MANAGED_PROFILE_USER_ID));
// verify profile credential
assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential(
profilePassword, 0, MANAGED_PROFILE_USER_ID)
profilePassword, MANAGED_PROFILE_USER_ID, 0 /* flags */)
.getResponseCode());
assertNotNull(mGateKeeperService.getAuthToken(MANAGED_PROFILE_USER_ID));
assertEquals(profileSid, mGateKeeperService.getSecureUserId(MANAGED_PROFILE_USER_ID));
@@ -203,7 +203,7 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests {
newPassword("pwd"), primaryPassword, PRIMARY_USER_ID));
mStorageManager.setIgnoreBadUnlock(false);
assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential(
profilePassword, 0, MANAGED_PROFILE_USER_ID)
profilePassword, MANAGED_PROFILE_USER_ID, 0 /* flags */)
.getResponseCode());
assertEquals(profileSid, mGateKeeperService.getSecureUserId(MANAGED_PROFILE_USER_ID));
}
@@ -389,7 +389,7 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests {
initializeStorageWithCredential(PRIMARY_USER_ID, password, 1234);
reset(mRecoverableKeyStoreManager);
mService.verifyCredential(password, 1, PRIMARY_USER_ID);
mService.verifyCredential(password, PRIMARY_USER_ID, 0 /* flags */);
verify(mRecoverableKeyStoreManager)
.lockScreenSecretAvailable(
@@ -406,7 +406,7 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests {
MANAGED_PROFILE_USER_ID));
reset(mRecoverableKeyStoreManager);
mService.verifyCredential(pattern, 1, MANAGED_PROFILE_USER_ID);
mService.verifyCredential(pattern, MANAGED_PROFILE_USER_ID, 0 /* flags */);
verify(mRecoverableKeyStoreManager)
.lockScreenSecretAvailable(
@@ -421,7 +421,7 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests {
mService.setSeparateProfileChallengeEnabled(MANAGED_PROFILE_USER_ID, false, null);
reset(mRecoverableKeyStoreManager);
mService.verifyCredential(pattern, 1, PRIMARY_USER_ID);
mService.verifyCredential(pattern, PRIMARY_USER_ID, 0 /* flags */);
// Parent sends its credentials for both the parent and profile.
verify(mRecoverableKeyStoreManager)
@@ -484,9 +484,8 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests {
private void assertVerifyCredentials(int userId, LockscreenCredential credential, long sid)
throws RemoteException{
final long challenge = 54321;
VerifyCredentialResponse response = mService.verifyCredential(credential,
challenge, userId);
VerifyCredentialResponse response = mService.verifyCredential(credential, userId,
0 /* flags */);
assertEquals(GateKeeperResponse.RESPONSE_OK, response.getResponseCode());
if (sid != -1) assertEquals(sid, mGateKeeperService.getSecureUserId(userId));
@@ -508,7 +507,7 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests {
badCredential = LockscreenCredential.createPin("0");
}
assertEquals(GateKeeperResponse.RESPONSE_ERROR, mService.verifyCredential(
badCredential, challenge, userId).getResponseCode());
badCredential, userId, 0 /* flags */).getResponseCode());
}
private void initializeStorageWithCredential(int userId, LockscreenCredential credential,

21
services/tests/servicestests/src/com/android/server/locksettings/LockscreenFrpTest.java
View File

@@ -52,7 +52,8 @@ public class LockscreenFrpTest extends BaseLockSettingsServiceTests {
assertEquals(CREDENTIAL_TYPE_PIN, mService.getCredentialType(USER_FRP));
assertEquals(VerifyCredentialResponse.RESPONSE_OK,
mService.verifyCredential(newPin("1234"), 0, USER_FRP).getResponseCode());
mService.verifyCredential(newPin("1234"), USER_FRP, 0 /* flags */)
.getResponseCode());
}
@Test
@@ -61,7 +62,8 @@ public class LockscreenFrpTest extends BaseLockSettingsServiceTests {
assertEquals(CREDENTIAL_TYPE_PATTERN, mService.getCredentialType(USER_FRP));
assertEquals(VerifyCredentialResponse.RESPONSE_OK,
mService.verifyCredential(newPattern("4321"), 0, USER_FRP).getResponseCode());
mService.verifyCredential(newPattern("4321"), USER_FRP, 0 /* flags */)
.getResponseCode());
}
@Test
@@ -70,7 +72,8 @@ public class LockscreenFrpTest extends BaseLockSettingsServiceTests {
assertEquals(CREDENTIAL_TYPE_PASSWORD, mService.getCredentialType(USER_FRP));
assertEquals(VerifyCredentialResponse.RESPONSE_OK,
mService.verifyCredential(newPassword("4321"), 0, USER_FRP).getResponseCode());
mService.verifyCredential(newPassword("4321"), USER_FRP, 0 /* flags */)
.getResponseCode());
}
@Test
@@ -80,7 +83,8 @@ public class LockscreenFrpTest extends BaseLockSettingsServiceTests {
assertEquals(CREDENTIAL_TYPE_PATTERN, mService.getCredentialType(USER_FRP));
assertEquals(VerifyCredentialResponse.RESPONSE_OK,
mService.verifyCredential(newPattern("5678"), 0, USER_FRP).getResponseCode());
mService.verifyCredential(newPattern("5678"), USER_FRP, 0 /* flags */)
.getResponseCode());
}
@Test
@@ -98,7 +102,8 @@ public class LockscreenFrpTest extends BaseLockSettingsServiceTests {
mSettings.setDeviceProvisioned(true);
assertEquals(VerifyCredentialResponse.RESPONSE_ERROR,
mService.verifyCredential(newPin("1234"), 0, USER_FRP).getResponseCode());
mService.verifyCredential(newPin("1234"), USER_FRP, 0 /* flags */)
.getResponseCode());
}
@Test
@@ -113,7 +118,8 @@ public class LockscreenFrpTest extends BaseLockSettingsServiceTests {
assertEquals(CREDENTIAL_TYPE_PIN, mService.getCredentialType(USER_FRP));
assertEquals(VerifyCredentialResponse.RESPONSE_OK,
mService.verifyCredential(newPin("1234"), 0, USER_FRP).getResponseCode());
mService.verifyCredential(newPin("1234"), USER_FRP, 0 /* flags */)
.getResponseCode());
}
@@ -129,6 +135,7 @@ public class LockscreenFrpTest extends BaseLockSettingsServiceTests {
assertEquals(CREDENTIAL_TYPE_PASSWORD, mService.getCredentialType(USER_FRP));
assertEquals(VerifyCredentialResponse.RESPONSE_OK,
mService.verifyCredential(newPin("1234"), 0, USER_FRP).getResponseCode());
mService.verifyCredential(newPin("1234"), USER_FRP, 0 /* flags */)
.getResponseCode());
}
}

48
services/tests/servicestests/src/com/android/server/locksettings/SyntheticPasswordTests.java
View File

@@ -119,8 +119,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests {
long sid = mGateKeeperService.getSecureUserId(PRIMARY_USER_ID);
mService.setLockCredential(newPassword, password, PRIMARY_USER_ID);
assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential(
newPassword, 0, PRIMARY_USER_ID)
.getResponseCode());
newPassword, PRIMARY_USER_ID, 0 /* flags */).getResponseCode());
assertEquals(sid, mGateKeeperService.getSecureUserId(PRIMARY_USER_ID));
}
@@ -131,12 +130,10 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests {
initializeCredentialUnderSP(password, PRIMARY_USER_ID);
assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential(
password, 0, PRIMARY_USER_ID)
.getResponseCode());
password, PRIMARY_USER_ID, 0 /* flags */).getResponseCode());
assertEquals(VerifyCredentialResponse.RESPONSE_ERROR, mService.verifyCredential(
badPassword, 0, PRIMARY_USER_ID)
.getResponseCode());
badPassword, PRIMARY_USER_ID, 0 /* flags */).getResponseCode());
}
@Test
@@ -153,8 +150,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests {
// set a new password
mService.setLockCredential(badPassword, nonePassword(), PRIMARY_USER_ID);
assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential(
badPassword, 0, PRIMARY_USER_ID)
.getResponseCode());
badPassword, PRIMARY_USER_ID, 0 /* flags */).getResponseCode());
assertNotEquals(sid, mGateKeeperService.getSecureUserId(PRIMARY_USER_ID));
}
@@ -166,8 +162,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests {
initializeCredentialUnderSP(password, PRIMARY_USER_ID);
mService.setLockCredential(badPassword, password, PRIMARY_USER_ID);
assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential(
badPassword, 0, PRIMARY_USER_ID)
.getResponseCode());
badPassword, PRIMARY_USER_ID, 0 /* flags */).getResponseCode());
// Check the same secret was passed each time
ArgumentCaptor<ArrayList<Byte>> secret = ArgumentCaptor.forClass(ArrayList.class);
@@ -183,8 +178,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests {
initializeCredentialUnderSP(password, PRIMARY_USER_ID);
reset(mAuthSecretService);
assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential(
password, 0, PRIMARY_USER_ID)
.getResponseCode());
password, PRIMARY_USER_ID, 0 /* flags */).getResponseCode());
verify(mAuthSecretService).primaryUserCredential(any(ArrayList.class));
}
@@ -194,8 +188,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests {
initializeCredentialUnderSP(password, SECONDARY_USER_ID);
assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential(
password, 0, SECONDARY_USER_ID)
.getResponseCode());
password, SECONDARY_USER_ID, 0 /* flags */).getResponseCode());
verify(mAuthSecretService, never()).primaryUserCredential(any(ArrayList.class));
}
@@ -246,7 +239,8 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests {
assertFalse(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID));
assertTrue(mService.hasPendingEscrowToken(PRIMARY_USER_ID));
mService.verifyCredential(password, 0, PRIMARY_USER_ID).getResponseCode();
mService.verifyCredential(password, PRIMARY_USER_ID, 0 /* flags */)
.getResponseCode();
assertTrue(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID));
assertFalse(mService.hasPendingEscrowToken(PRIMARY_USER_ID));
@@ -259,8 +253,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests {
verify(mDevicePolicyManager).reportPasswordChanged(PRIMARY_USER_ID);
assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential(
pattern, 0, PRIMARY_USER_ID)
.getResponseCode());
pattern, PRIMARY_USER_ID, 0 /* flags */).getResponseCode());
assertArrayEquals(storageKey, mStorageManager.getUserUnlockToken(PRIMARY_USER_ID));
}
@@ -275,7 +268,8 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests {
long handle = mLocalService.addEscrowToken(token, PRIMARY_USER_ID, null);
assertFalse(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID));
mService.verifyCredential(password, 0, PRIMARY_USER_ID).getResponseCode();
mService.verifyCredential(password, PRIMARY_USER_ID, 0 /* flags */)
.getResponseCode();
assertTrue(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID));
mLocalService.setLockCredentialWithToken(nonePassword(), handle, token, PRIMARY_USER_ID);
@@ -284,8 +278,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests {
PRIMARY_USER_ID);
assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential(
pattern, 0, PRIMARY_USER_ID)
.getResponseCode());
pattern, PRIMARY_USER_ID, 0 /* flags */).getResponseCode());
assertArrayEquals(storageKey, mStorageManager.getUserUnlockToken(PRIMARY_USER_ID));
}
@@ -301,7 +294,8 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests {
long handle = mLocalService.addEscrowToken(token, PRIMARY_USER_ID, null);
assertFalse(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID));
mService.verifyCredential(password, 0, PRIMARY_USER_ID).getResponseCode();
mService.verifyCredential(password, PRIMARY_USER_ID, 0 /* flags */)
.getResponseCode();
assertTrue(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID));
mService.setLockCredential(pattern, password, PRIMARY_USER_ID);
@@ -309,8 +303,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests {
mLocalService.setLockCredentialWithToken(newPassword, handle, token, PRIMARY_USER_ID);
assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential(
newPassword, 0, PRIMARY_USER_ID)
.getResponseCode());
newPassword, PRIMARY_USER_ID, 0 /* flags */).getResponseCode());
assertArrayEquals(storageKey, mStorageManager.getUserUnlockToken(PRIMARY_USER_ID));
}
@@ -357,8 +350,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests {
assertFalse(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID));
// Activate token (password gets migrated to SP at the same time)
assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential(
password, 0, PRIMARY_USER_ID)
.getResponseCode());
password, PRIMARY_USER_ID, 0 /* flags */).getResponseCode());
// Verify token is activated
assertTrue(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID));
}
@@ -488,8 +480,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests {
initializeCredentialUnderSP(password, PRIMARY_USER_ID);
assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential(
password, 0, PRIMARY_USER_ID)
.getResponseCode());
password, PRIMARY_USER_ID, 0 /* flags */).getResponseCode());
verify(mAuthSecretService, never()).primaryUserCredential(any(ArrayList.class));
}
@@ -503,7 +494,8 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests {
reset(mDevicePolicyManager);
long handle = mLocalService.addEscrowToken(token, PRIMARY_USER_ID, null);
mService.verifyCredential(password, 0, PRIMARY_USER_ID).getResponseCode();
mService.verifyCredential(password, PRIMARY_USER_ID, 0 /* flags */)
.getResponseCode();
assertTrue(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID));
mService.onCleanupUser(PRIMARY_USER_ID);