AppAuthenticator

public static final int PERMISSION_DENIED_NO_MATCH = -3

This is returned by checkCallingAppIdentity and checkCallingAppIdentity when the specified package name does not have any of the expected signing identities for the provided permission.

public static final int PERMISSION_DENIED_PACKAGE_UID_MISMATCH = -5

This is returned by checkCallingAppIdentity and checkCallingAppIdentity when the specified package name does not belong to the provided calling UID, or if the UID is not provided and the specified package name does not belong to the UID of the calling process as returned by getCallingUid.

public static final int PERMISSION_DENIED_UNKNOWN_PACKAGE = -4

This is returned by checkCallingAppIdentity and checkCallingAppIdentity when the specified package name does not belong to an app installed on the device.

public static final int PERMISSION_GRANTED = 0

This is returned by checkCallingAppIdentity and checkCallingAppIdentity when the specified package name has the expected signing identity for the provided permission.

public static final int SIGNATURE_MATCH = 0

This is returned by checkAppIdentity when the specified package name has the expected signing identity.

public static final int SIGNATURE_NO_MATCH = -1

This is returned by checkAppIdentity when the specified package name does not have the expected signing identity.

public int checkAppIdentity(@NonNull String packageName)

Checks the specified packageName has the expected signing identity as specified in the <expected-identity> tag.

This method should be used when an app's signing identity must be verified; for instance before a client connects to an exported service this method can be used to verify that the app comes from the expected developer.

public int checkCallingAppIdentity(
    @NonNull String packageName,
    @NonNull String permission
)

Checks the specified packageName has the expected signing identity for the provided permission.

This method should be used for verifying the identity of a package when the UID / PID is not available. For instance, this should be used within an activity that was started with startActivityForResult where the package name is available from getCallingPackage. For instances where the calling UID is available but the calling PID is not available, (checkCallingAppIdentity should be preferred.

public int checkCallingAppIdentity(
    @NonNull String packageName,
    @NonNull String permission,
    int uid
)

Checks the specified packageName running under uid has the expected signing identity for the provided permission.

This method should be used for verifying the identity of a package when the UID is available but the PID is not. For instance, this should be used within an activity that is started with setShareIdentityEnabled set to true; the package name would then be accessible via getLaunchedFromPackage and the UID from getLaunchedFromUid.

public int checkCallingAppIdentity(
    @NonNull String packageName,
    @NonNull String permission,
    int pid,
    int uid
)

Checks the specified packageName running with pid and uid has the expected signing identity for the provided permission.

This method should be used for verifying the identity of a calling process of an IPC.

public static @NonNull AppAuthenticator createFromInputStream(
    @NonNull Context context,
    @NonNull InputStream xmlInputStream
)

Creates a new AppAuthenticator that can be used to guard resources based on package name / signing identity as well as allow verification of expected signing identities before interacting with other apps on a device using the configuration defined in the provided xmlInputStream.

public static @NonNull AppAuthenticator createFromResource(@NonNull Context context, @XmlRes int xmlResource)

Creates a new AppAuthenticator that can be used to guard resources based on package name / signing identity as well as allow verification of expected signing identities before interacting with other apps on a device using the configuration defined in the provided XML resource.

public void enforceAppIdentity(@NonNull String packageName)

Enforces the specified packageName has the expected signing identity as declared in the <expected-identity> tag.

This method should be used when an app's signing identity must be verified; for instance before a client connects to an exported service this method can be used to verify that the app comes from the expected developer.

public void enforceCallingAppIdentity(
    @NonNull String packageName,
    @NonNull String permission
)

Enforces the specified packageName has the expected signing identity for the provided permission.

This method should be used for verifying the identity of a package when the UID / PID is not available. For instance, this should be used within an activity that was started with startActivityForResult where the package name is available from getCallingPackage. For instances where the calling UID is available but the calling PID is not available, (checkCallingAppIdentity should be preferred.

public void enforceCallingAppIdentity(
    @NonNull String packageName,
    @NonNull String permission,
    int uid
)

Enforces the specified packageName belongs to the provided uid and has the expected signing identity for the permission.

This method should be used for verifying the identity of a package when the UID is available but the PID is not. For instance, this should be used within an activity that is started with setShareIdentityEnabled set to true; the package name would then be accessible via getLaunchedFromPackage and the UID from getLaunchedFromUid.

public void enforceCallingAppIdentity(
    @NonNull String packageName,
    @NonNull String permission,
    int pid,
    int uid
)

Enforces the specified packageName belongs to the provided pid / uid and has the expected signing identity for the permission.

This method should be used for verifying the identity of a calling process of an IPC.