diff --git a/core/java/android/hardware/face/FaceManager.java b/core/java/android/hardware/face/FaceManager.java index 885d137dd2fe3..19cb13c7e1148 100644 --- a/core/java/android/hardware/face/FaceManager.java +++ b/core/java/android/hardware/face/FaceManager.java @@ -1073,12 +1073,12 @@ public class FaceManager implements BiometricAuthenticator, BiometricFaceConstan /** * @hide */ - public abstract static class GenerateChallengeCallback { - public abstract void onGenerateChallengeResult(long challenge); + public interface GenerateChallengeCallback { + void onGenerateChallengeResult(long challenge); } private abstract static class InternalGenerateChallengeCallback - extends GenerateChallengeCallback {} + implements GenerateChallengeCallback {} private class OnEnrollCancelListener implements OnCancelListener { @Override diff --git a/core/java/com/android/internal/widget/ILockSettings.aidl b/core/java/com/android/internal/widget/ILockSettings.aidl index a5a42e1afcdc4..d5d635de81d84 100644 --- a/core/java/com/android/internal/widget/ILockSettings.aidl +++ b/core/java/com/android/internal/widget/ILockSettings.aidl @@ -47,8 +47,8 @@ interface ILockSettings { void resetKeyStore(int userId); VerifyCredentialResponse checkCredential(in LockscreenCredential credential, int userId, in ICheckCredentialProgressCallback progressCallback); - VerifyCredentialResponse verifyCredential(in LockscreenCredential credential, long challenge, int userId, int flags); - VerifyCredentialResponse verifyTiedProfileChallenge(in LockscreenCredential credential, long challenge, int userId, int flags); + VerifyCredentialResponse verifyCredential(in LockscreenCredential credential, int userId, int flags); + VerifyCredentialResponse verifyTiedProfileChallenge(in LockscreenCredential credential, int userId, int flags); VerifyCredentialResponse verifyGatekeeperPassword(in byte[] gatekeeperPassword, long challenge, int userId); boolean checkVoldPassword(int userId); int getCredentialType(int userId); diff --git a/core/java/com/android/internal/widget/LockPatternChecker.java b/core/java/com/android/internal/widget/LockPatternChecker.java index a71ca8734e75d..5adbc583140fe 100644 --- a/core/java/com/android/internal/widget/LockPatternChecker.java +++ b/core/java/com/android/internal/widget/LockPatternChecker.java @@ -54,14 +54,12 @@ public final class LockPatternChecker { * * @param utils The LockPatternUtils instance to use. * @param credential The credential to check. - * @param challenge The challenge to verify against the credential. * @param userId The user to check against the credential. * @param flags See {@link LockPatternUtils.VerifyFlag} * @param callback The callback to be invoked with the verification result. */ public static AsyncTask verifyCredential(final LockPatternUtils utils, final LockscreenCredential credential, - final long challenge, final int userId, final @LockPatternUtils.VerifyFlag int flags, final OnVerifyCallback callback) { @@ -71,7 +69,7 @@ public final class LockPatternChecker { new AsyncTask() { @Override protected VerifyCredentialResponse doInBackground(Void... args) { - return utils.verifyCredential(credentialCopy, challenge, userId, flags); + return utils.verifyCredential(credentialCopy, userId, flags); } @Override @@ -138,14 +136,12 @@ public final class LockPatternChecker { * * @param utils The LockPatternUtils instance to use. * @param credential The credential to check. - * @param challenge The challenge to verify against the credential. * @param userId The user to check against the credential. * @param flags See {@link LockPatternUtils.VerifyFlag} * @param callback The callback to be invoked with the verification result. */ public static AsyncTask verifyTiedProfileChallenge(final LockPatternUtils utils, final LockscreenCredential credential, - final long challenge, final int userId, final @LockPatternUtils.VerifyFlag int flags, final OnVerifyCallback callback) { @@ -155,7 +151,7 @@ public final class LockPatternChecker { new AsyncTask() { @Override protected VerifyCredentialResponse doInBackground(Void... args) { - return utils.verifyTiedProfileChallenge(credentialCopy, challenge, userId, flags); + return utils.verifyTiedProfileChallenge(credentialCopy, userId, flags); } @Override diff --git a/core/java/com/android/internal/widget/LockPatternUtils.java b/core/java/com/android/internal/widget/LockPatternUtils.java index 206227344b963..f7370d6a22f97 100644 --- a/core/java/com/android/internal/widget/LockPatternUtils.java +++ b/core/java/com/android/internal/widget/LockPatternUtils.java @@ -386,18 +386,17 @@ public class LockPatternUtils { * If credential matches, return an opaque attestation that the challenge was verified. * * @param credential The credential to check. - * @param challenge The challenge to verify against the credential * @param userId The user whose credential is being verified * @param flags See {@link VerifyFlag} * @throws IllegalStateException if called on the main thread. */ @NonNull public VerifyCredentialResponse verifyCredential(@NonNull LockscreenCredential credential, - long challenge, int userId, @VerifyFlag int flags) { + int userId, @VerifyFlag int flags) { throwIfCalledOnMainThread(); try { final VerifyCredentialResponse response = getLockSettings().verifyCredential( - credential, challenge, userId, flags); + credential, userId, flags); if (response == null) { return VerifyCredentialResponse.ERROR; } else { @@ -411,8 +410,8 @@ public class LockPatternUtils { /** * With the Gatekeeper Password returned via {@link #verifyCredential(LockscreenCredential, - * long, int, boolean)}, request Gatekeeper to create a HardwareAuthToken wrapping the - * given challenge. + * int, int)}, request Gatekeeper to create a HardwareAuthToken wrapping the given + * challenge. */ @NonNull public VerifyCredentialResponse verifyGatekeeperPassword(@NonNull byte[] gatekeeperPassword, @@ -470,7 +469,6 @@ public class LockPatternUtils { * verified. * * @param credential The parent user's credential to check. - * @param challenge The challenge to verify against the credential * @return the attestation that the challenge was verified, or null * @param userId The managed profile user id * @param flags See {@link VerifyFlag} @@ -478,12 +476,11 @@ public class LockPatternUtils { */ @NonNull public VerifyCredentialResponse verifyTiedProfileChallenge( - @NonNull LockscreenCredential credential, - long challenge, int userId, @VerifyFlag int flags) { + @NonNull LockscreenCredential credential, int userId, @VerifyFlag int flags) { throwIfCalledOnMainThread(); try { final VerifyCredentialResponse response = getLockSettings() - .verifyTiedProfileChallenge(credential, challenge, userId, flags); + .verifyTiedProfileChallenge(credential, userId, flags); if (response == null) { return VerifyCredentialResponse.ERROR; } else { diff --git a/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialPasswordView.java b/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialPasswordView.java index fe20d894274f2..d4e6506bd9a0d 100644 --- a/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialPasswordView.java +++ b/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialPasswordView.java @@ -28,6 +28,7 @@ import android.widget.ImeAwareEditText; import android.widget.TextView; import com.android.internal.widget.LockPatternChecker; +import com.android.internal.widget.LockPatternUtils; import com.android.internal.widget.LockscreenCredential; import com.android.internal.widget.VerifyCredentialResponse; import com.android.systemui.R; @@ -106,8 +107,11 @@ public class AuthCredentialPasswordView extends AuthCredentialView return; } + // Request LockSettingsService to return the Gatekeeper Password in the + // VerifyCredentialResponse so that we can request a Gatekeeper HAT with the + // Gatekeeper Password and operationId. mPendingLockCheck = LockPatternChecker.verifyCredential(mLockPatternUtils, - password, mOperationId, mEffectiveUserId, 0 /* flags */, + password, mEffectiveUserId, LockPatternUtils.VERIFY_FLAG_RETURN_GK_PW, this::onCredentialVerified); } } diff --git a/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialPatternView.java b/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialPatternView.java index 0573ef0067dbe..ad89ae82f6376 100644 --- a/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialPatternView.java +++ b/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialPatternView.java @@ -68,12 +68,14 @@ public class AuthCredentialPatternView extends AuthCredentialView { } try (LockscreenCredential credential = LockscreenCredential.createPattern(pattern)) { + // Request LockSettingsService to return the Gatekeeper Password in the + // VerifyCredentialResponse so that we can request a Gatekeeper HAT with the + // Gatekeeper Password and operationId. mPendingLockCheck = LockPatternChecker.verifyCredential( mLockPatternUtils, credential, - mOperationId, mEffectiveUserId, - 0 /* flags */, + LockPatternUtils.VERIFY_FLAG_RETURN_GK_PW, this::onPatternVerified); } } diff --git a/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialView.java b/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialView.java index 101474be0ea8a..a8f6f85201f6f 100644 --- a/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialView.java +++ b/packages/SystemUI/src/com/android/systemui/biometrics/AuthCredentialView.java @@ -288,7 +288,14 @@ public abstract class AuthCredentialView extends LinearLayout { if (response.isMatched()) { mClearErrorRunnable.run(); mLockPatternUtils.userPresent(mEffectiveUserId); - mCallback.onCredentialMatched(response.getGatekeeperHAT()); + + // The response passed into this method contains the Gatekeeper Password. We still + // have to request Gatekeeper to create a Hardware Auth Token with the + // Gatekeeper Password and Challenge (keystore operationId in this case) + final VerifyCredentialResponse gkResponse = mLockPatternUtils.verifyGatekeeperPassword( + response.getGatekeeperPw(), mOperationId, mEffectiveUserId); + + mCallback.onCredentialMatched(gkResponse.getGatekeeperHAT()); } else { if (timeoutMs > 0) { mHandler.removeCallbacks(mClearErrorRunnable); diff --git a/services/core/java/com/android/server/locksettings/LockSettingsService.java b/services/core/java/com/android/server/locksettings/LockSettingsService.java index 127d5cc390370..d6e37bacdba8a 100644 --- a/services/core/java/com/android/server/locksettings/LockSettingsService.java +++ b/services/core/java/com/android/server/locksettings/LockSettingsService.java @@ -187,6 +187,9 @@ public class LockSettingsService extends ILockSettings.Stub { private static final String SYNTHETIC_PASSWORD_UPDATE_TIME_KEY = "sp-handle-ts"; private static final String USER_SERIAL_NUMBER_KEY = "serial-number"; + // TODO (b/145978626) LockSettingsService no longer accepts challenges in the verifyCredential + // paths. These are temporarily left around to ensure that resetLockout works. It will be + // removed once resetLockout is compartmentalized. // No challenge provided private static final int CHALLENGE_NONE = 0; // Challenge was provided from the external caller (non-LockSettingsService) @@ -1609,8 +1612,8 @@ public class LockSettingsService extends ILockSettings.Stub { // Verify the parent credential again, to make sure we have a fresh enough // auth token such that getDecryptedPasswordForTiedProfile() inside // setLockCredentialInternal() can function correctly. - verifyCredential(savedCredential, /* challenge */ 0, - mUserManager.getProfileParent(userId).id, 0 /* flags */); + verifyCredential(savedCredential, mUserManager.getProfileParent(userId).id, + 0 /* flags */); savedCredential.zeroize(); savedCredential = LockscreenCredential.createNone(); } @@ -1969,7 +1972,7 @@ public class LockSettingsService extends ILockSettings.Stub { ICheckCredentialProgressCallback progressCallback) { checkPasswordReadPermission(userId); try { - return doVerifyCredential(credential, CHALLENGE_NONE, 0, userId, progressCallback, + return doVerifyCredential(credential, CHALLENGE_NONE, 0L, userId, progressCallback, 0 /* flags */); } finally { scheduleGc(); @@ -1979,21 +1982,11 @@ public class LockSettingsService extends ILockSettings.Stub { @Override @Nullable public VerifyCredentialResponse verifyCredential(LockscreenCredential credential, - long challenge, int userId, @LockPatternUtils.VerifyFlag int flags) { + int userId, int flags) { checkPasswordReadPermission(userId); - @ChallengeType int challengeType = CHALLENGE_FROM_CALLER; - if (challenge == 0) { - Slog.w(TAG, "VerifyCredential called with challenge=0"); - challengeType = CHALLENGE_NONE; - } - if (challenge != 0 && ((flags & VERIFY_FLAG_RETURN_GK_PW) != 0)) { - // Caller requests Gatekeeper Password to be returned. Challenge is a no-op here, since - // its only used when Gatekeeper verifies the SP. - Slog.w(TAG, "Challenge will not be used"); - } try { - return doVerifyCredential(credential, challengeType, challenge, userId, + return doVerifyCredential(credential, CHALLENGE_NONE, 0L, userId, null /* progressCallback */, flags); } finally { scheduleGc(); @@ -2083,7 +2076,7 @@ public class LockSettingsService extends ILockSettings.Stub { @Override public VerifyCredentialResponse verifyTiedProfileChallenge(LockscreenCredential credential, - long challenge, int userId, @LockPatternUtils.VerifyFlag int flags) { + int userId, @LockPatternUtils.VerifyFlag int flags) { checkPasswordReadPermission(userId); if (!isManagedProfileWithUnifiedLock(userId)) { throw new IllegalArgumentException("User id must be managed profile with unified lock"); @@ -2092,8 +2085,8 @@ public class LockSettingsService extends ILockSettings.Stub { // Unlock parent by using parent's challenge final VerifyCredentialResponse parentResponse = doVerifyCredential( credential, - CHALLENGE_FROM_CALLER, - challenge, + CHALLENGE_NONE, + 0L, parentProfileId, null /* progressCallback */, flags); @@ -2105,8 +2098,8 @@ public class LockSettingsService extends ILockSettings.Stub { try { // Unlock work profile, and work profile with unified lock must use password only return doVerifyCredential(getDecryptedPasswordForTiedProfile(userId), - CHALLENGE_FROM_CALLER, - challenge, + CHALLENGE_NONE, + 0L, userId, null /* progressCallback */, flags); } catch (UnrecoverableKeyException | InvalidKeyException | KeyStoreException diff --git a/services/tests/servicestests/src/com/android/server/locksettings/LockSettingsServiceTests.java b/services/tests/servicestests/src/com/android/server/locksettings/LockSettingsServiceTests.java index 12b144f2b7789..1f66c7c02658b 100644 --- a/services/tests/servicestests/src/com/android/server/locksettings/LockSettingsServiceTests.java +++ b/services/tests/servicestests/src/com/android/server/locksettings/LockSettingsServiceTests.java @@ -129,7 +129,7 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests { mGateKeeperService.clearAuthToken(TURNED_OFF_PROFILE_USER_ID); // verify credential assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - firstUnifiedPassword, 0, PRIMARY_USER_ID) + firstUnifiedPassword, PRIMARY_USER_ID, 0 /* flags */) .getResponseCode()); // Verify that we have a new auth token for the profile @@ -186,13 +186,13 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests { mGateKeeperService.clearAuthToken(MANAGED_PROFILE_USER_ID); // verify primary credential assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - primaryPassword, 0, PRIMARY_USER_ID) + primaryPassword, PRIMARY_USER_ID, 0 /* flags */) .getResponseCode()); assertNull(mGateKeeperService.getAuthToken(MANAGED_PROFILE_USER_ID)); // verify profile credential assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - profilePassword, 0, MANAGED_PROFILE_USER_ID) + profilePassword, MANAGED_PROFILE_USER_ID, 0 /* flags */) .getResponseCode()); assertNotNull(mGateKeeperService.getAuthToken(MANAGED_PROFILE_USER_ID)); assertEquals(profileSid, mGateKeeperService.getSecureUserId(MANAGED_PROFILE_USER_ID)); @@ -203,7 +203,7 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests { newPassword("pwd"), primaryPassword, PRIMARY_USER_ID)); mStorageManager.setIgnoreBadUnlock(false); assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - profilePassword, 0, MANAGED_PROFILE_USER_ID) + profilePassword, MANAGED_PROFILE_USER_ID, 0 /* flags */) .getResponseCode()); assertEquals(profileSid, mGateKeeperService.getSecureUserId(MANAGED_PROFILE_USER_ID)); } @@ -389,7 +389,7 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests { initializeStorageWithCredential(PRIMARY_USER_ID, password, 1234); reset(mRecoverableKeyStoreManager); - mService.verifyCredential(password, 1, PRIMARY_USER_ID); + mService.verifyCredential(password, PRIMARY_USER_ID, 0 /* flags */); verify(mRecoverableKeyStoreManager) .lockScreenSecretAvailable( @@ -406,7 +406,7 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests { MANAGED_PROFILE_USER_ID)); reset(mRecoverableKeyStoreManager); - mService.verifyCredential(pattern, 1, MANAGED_PROFILE_USER_ID); + mService.verifyCredential(pattern, MANAGED_PROFILE_USER_ID, 0 /* flags */); verify(mRecoverableKeyStoreManager) .lockScreenSecretAvailable( @@ -421,7 +421,7 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests { mService.setSeparateProfileChallengeEnabled(MANAGED_PROFILE_USER_ID, false, null); reset(mRecoverableKeyStoreManager); - mService.verifyCredential(pattern, 1, PRIMARY_USER_ID); + mService.verifyCredential(pattern, PRIMARY_USER_ID, 0 /* flags */); // Parent sends its credentials for both the parent and profile. verify(mRecoverableKeyStoreManager) @@ -484,9 +484,8 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests { private void assertVerifyCredentials(int userId, LockscreenCredential credential, long sid) throws RemoteException{ - final long challenge = 54321; - VerifyCredentialResponse response = mService.verifyCredential(credential, - challenge, userId); + VerifyCredentialResponse response = mService.verifyCredential(credential, userId, + 0 /* flags */); assertEquals(GateKeeperResponse.RESPONSE_OK, response.getResponseCode()); if (sid != -1) assertEquals(sid, mGateKeeperService.getSecureUserId(userId)); @@ -508,7 +507,7 @@ public class LockSettingsServiceTests extends BaseLockSettingsServiceTests { badCredential = LockscreenCredential.createPin("0"); } assertEquals(GateKeeperResponse.RESPONSE_ERROR, mService.verifyCredential( - badCredential, challenge, userId).getResponseCode()); + badCredential, userId, 0 /* flags */).getResponseCode()); } private void initializeStorageWithCredential(int userId, LockscreenCredential credential, diff --git a/services/tests/servicestests/src/com/android/server/locksettings/LockscreenFrpTest.java b/services/tests/servicestests/src/com/android/server/locksettings/LockscreenFrpTest.java index 4b3f7b5d08ef6..9c0239b2b6a6e 100644 --- a/services/tests/servicestests/src/com/android/server/locksettings/LockscreenFrpTest.java +++ b/services/tests/servicestests/src/com/android/server/locksettings/LockscreenFrpTest.java @@ -52,7 +52,8 @@ public class LockscreenFrpTest extends BaseLockSettingsServiceTests { assertEquals(CREDENTIAL_TYPE_PIN, mService.getCredentialType(USER_FRP)); assertEquals(VerifyCredentialResponse.RESPONSE_OK, - mService.verifyCredential(newPin("1234"), 0, USER_FRP).getResponseCode()); + mService.verifyCredential(newPin("1234"), USER_FRP, 0 /* flags */) + .getResponseCode()); } @Test @@ -61,7 +62,8 @@ public class LockscreenFrpTest extends BaseLockSettingsServiceTests { assertEquals(CREDENTIAL_TYPE_PATTERN, mService.getCredentialType(USER_FRP)); assertEquals(VerifyCredentialResponse.RESPONSE_OK, - mService.verifyCredential(newPattern("4321"), 0, USER_FRP).getResponseCode()); + mService.verifyCredential(newPattern("4321"), USER_FRP, 0 /* flags */) + .getResponseCode()); } @Test @@ -70,7 +72,8 @@ public class LockscreenFrpTest extends BaseLockSettingsServiceTests { assertEquals(CREDENTIAL_TYPE_PASSWORD, mService.getCredentialType(USER_FRP)); assertEquals(VerifyCredentialResponse.RESPONSE_OK, - mService.verifyCredential(newPassword("4321"), 0, USER_FRP).getResponseCode()); + mService.verifyCredential(newPassword("4321"), USER_FRP, 0 /* flags */) + .getResponseCode()); } @Test @@ -80,7 +83,8 @@ public class LockscreenFrpTest extends BaseLockSettingsServiceTests { assertEquals(CREDENTIAL_TYPE_PATTERN, mService.getCredentialType(USER_FRP)); assertEquals(VerifyCredentialResponse.RESPONSE_OK, - mService.verifyCredential(newPattern("5678"), 0, USER_FRP).getResponseCode()); + mService.verifyCredential(newPattern("5678"), USER_FRP, 0 /* flags */) + .getResponseCode()); } @Test @@ -98,7 +102,8 @@ public class LockscreenFrpTest extends BaseLockSettingsServiceTests { mSettings.setDeviceProvisioned(true); assertEquals(VerifyCredentialResponse.RESPONSE_ERROR, - mService.verifyCredential(newPin("1234"), 0, USER_FRP).getResponseCode()); + mService.verifyCredential(newPin("1234"), USER_FRP, 0 /* flags */) + .getResponseCode()); } @Test @@ -113,7 +118,8 @@ public class LockscreenFrpTest extends BaseLockSettingsServiceTests { assertEquals(CREDENTIAL_TYPE_PIN, mService.getCredentialType(USER_FRP)); assertEquals(VerifyCredentialResponse.RESPONSE_OK, - mService.verifyCredential(newPin("1234"), 0, USER_FRP).getResponseCode()); + mService.verifyCredential(newPin("1234"), USER_FRP, 0 /* flags */) + .getResponseCode()); } @@ -129,6 +135,7 @@ public class LockscreenFrpTest extends BaseLockSettingsServiceTests { assertEquals(CREDENTIAL_TYPE_PASSWORD, mService.getCredentialType(USER_FRP)); assertEquals(VerifyCredentialResponse.RESPONSE_OK, - mService.verifyCredential(newPin("1234"), 0, USER_FRP).getResponseCode()); + mService.verifyCredential(newPin("1234"), USER_FRP, 0 /* flags */) + .getResponseCode()); } } diff --git a/services/tests/servicestests/src/com/android/server/locksettings/SyntheticPasswordTests.java b/services/tests/servicestests/src/com/android/server/locksettings/SyntheticPasswordTests.java index ba851992cbad9..2bd0e55f7d21b 100644 --- a/services/tests/servicestests/src/com/android/server/locksettings/SyntheticPasswordTests.java +++ b/services/tests/servicestests/src/com/android/server/locksettings/SyntheticPasswordTests.java @@ -119,8 +119,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { long sid = mGateKeeperService.getSecureUserId(PRIMARY_USER_ID); mService.setLockCredential(newPassword, password, PRIMARY_USER_ID); assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - newPassword, 0, PRIMARY_USER_ID) - .getResponseCode()); + newPassword, PRIMARY_USER_ID, 0 /* flags */).getResponseCode()); assertEquals(sid, mGateKeeperService.getSecureUserId(PRIMARY_USER_ID)); } @@ -131,12 +130,10 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { initializeCredentialUnderSP(password, PRIMARY_USER_ID); assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - password, 0, PRIMARY_USER_ID) - .getResponseCode()); + password, PRIMARY_USER_ID, 0 /* flags */).getResponseCode()); assertEquals(VerifyCredentialResponse.RESPONSE_ERROR, mService.verifyCredential( - badPassword, 0, PRIMARY_USER_ID) - .getResponseCode()); + badPassword, PRIMARY_USER_ID, 0 /* flags */).getResponseCode()); } @Test @@ -153,8 +150,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { // set a new password mService.setLockCredential(badPassword, nonePassword(), PRIMARY_USER_ID); assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - badPassword, 0, PRIMARY_USER_ID) - .getResponseCode()); + badPassword, PRIMARY_USER_ID, 0 /* flags */).getResponseCode()); assertNotEquals(sid, mGateKeeperService.getSecureUserId(PRIMARY_USER_ID)); } @@ -166,8 +162,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { initializeCredentialUnderSP(password, PRIMARY_USER_ID); mService.setLockCredential(badPassword, password, PRIMARY_USER_ID); assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - badPassword, 0, PRIMARY_USER_ID) - .getResponseCode()); + badPassword, PRIMARY_USER_ID, 0 /* flags */).getResponseCode()); // Check the same secret was passed each time ArgumentCaptor> secret = ArgumentCaptor.forClass(ArrayList.class); @@ -183,8 +178,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { initializeCredentialUnderSP(password, PRIMARY_USER_ID); reset(mAuthSecretService); assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - password, 0, PRIMARY_USER_ID) - .getResponseCode()); + password, PRIMARY_USER_ID, 0 /* flags */).getResponseCode()); verify(mAuthSecretService).primaryUserCredential(any(ArrayList.class)); } @@ -194,8 +188,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { initializeCredentialUnderSP(password, SECONDARY_USER_ID); assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - password, 0, SECONDARY_USER_ID) - .getResponseCode()); + password, SECONDARY_USER_ID, 0 /* flags */).getResponseCode()); verify(mAuthSecretService, never()).primaryUserCredential(any(ArrayList.class)); } @@ -246,7 +239,8 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { assertFalse(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID)); assertTrue(mService.hasPendingEscrowToken(PRIMARY_USER_ID)); - mService.verifyCredential(password, 0, PRIMARY_USER_ID).getResponseCode(); + mService.verifyCredential(password, PRIMARY_USER_ID, 0 /* flags */) + .getResponseCode(); assertTrue(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID)); assertFalse(mService.hasPendingEscrowToken(PRIMARY_USER_ID)); @@ -259,8 +253,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { verify(mDevicePolicyManager).reportPasswordChanged(PRIMARY_USER_ID); assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - pattern, 0, PRIMARY_USER_ID) - .getResponseCode()); + pattern, PRIMARY_USER_ID, 0 /* flags */).getResponseCode()); assertArrayEquals(storageKey, mStorageManager.getUserUnlockToken(PRIMARY_USER_ID)); } @@ -275,7 +268,8 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { long handle = mLocalService.addEscrowToken(token, PRIMARY_USER_ID, null); assertFalse(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID)); - mService.verifyCredential(password, 0, PRIMARY_USER_ID).getResponseCode(); + mService.verifyCredential(password, PRIMARY_USER_ID, 0 /* flags */) + .getResponseCode(); assertTrue(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID)); mLocalService.setLockCredentialWithToken(nonePassword(), handle, token, PRIMARY_USER_ID); @@ -284,8 +278,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { PRIMARY_USER_ID); assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - pattern, 0, PRIMARY_USER_ID) - .getResponseCode()); + pattern, PRIMARY_USER_ID, 0 /* flags */).getResponseCode()); assertArrayEquals(storageKey, mStorageManager.getUserUnlockToken(PRIMARY_USER_ID)); } @@ -301,7 +294,8 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { long handle = mLocalService.addEscrowToken(token, PRIMARY_USER_ID, null); assertFalse(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID)); - mService.verifyCredential(password, 0, PRIMARY_USER_ID).getResponseCode(); + mService.verifyCredential(password, PRIMARY_USER_ID, 0 /* flags */) + .getResponseCode(); assertTrue(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID)); mService.setLockCredential(pattern, password, PRIMARY_USER_ID); @@ -309,8 +303,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { mLocalService.setLockCredentialWithToken(newPassword, handle, token, PRIMARY_USER_ID); assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - newPassword, 0, PRIMARY_USER_ID) - .getResponseCode()); + newPassword, PRIMARY_USER_ID, 0 /* flags */).getResponseCode()); assertArrayEquals(storageKey, mStorageManager.getUserUnlockToken(PRIMARY_USER_ID)); } @@ -357,8 +350,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { assertFalse(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID)); // Activate token (password gets migrated to SP at the same time) assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - password, 0, PRIMARY_USER_ID) - .getResponseCode()); + password, PRIMARY_USER_ID, 0 /* flags */).getResponseCode()); // Verify token is activated assertTrue(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID)); } @@ -488,8 +480,7 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { initializeCredentialUnderSP(password, PRIMARY_USER_ID); assertEquals(VerifyCredentialResponse.RESPONSE_OK, mService.verifyCredential( - password, 0, PRIMARY_USER_ID) - .getResponseCode()); + password, PRIMARY_USER_ID, 0 /* flags */).getResponseCode()); verify(mAuthSecretService, never()).primaryUserCredential(any(ArrayList.class)); } @@ -503,7 +494,8 @@ public class SyntheticPasswordTests extends BaseLockSettingsServiceTests { reset(mDevicePolicyManager); long handle = mLocalService.addEscrowToken(token, PRIMARY_USER_ID, null); - mService.verifyCredential(password, 0, PRIMARY_USER_ID).getResponseCode(); + mService.verifyCredential(password, PRIMARY_USER_ID, 0 /* flags */) + .getResponseCode(); assertTrue(mLocalService.isEscrowTokenActive(handle, PRIMARY_USER_ID)); mService.onCleanupUser(PRIMARY_USER_ID);