Android AccountManager's getAuthToken Security

2019-07-20 23:54发布

问题:

i (lets say app 'C' )am trying to get the auth token of an installed app ( say 'S' ) through Android's AccountManager's getAuthToken function.

this function is not working as expected, it doesn't return any results (the run function is never called )

 AccountManagerFuture<Bundle> future1 = AccountManager.get(Main2.this).getAuthToken(account,account.type,null,false, new AccountManagerCallback<Bundle>() {
                    @Override
                    public void run(AccountManagerFuture<Bundle> future) {
                        Bundle result = null;
                        try {
                            result =   future.getResult();
                            String check = "";
                        }
                        catch (OperationCanceledException e){          }
                        catch (IOException e1){}
                        catch (AuthenticatorException e2){}

                    }
                } , new Handler(Looper.getMainLooper()));

when i see the device ADB Logs, i see the following

 java.lang.SecurityException: Activity to be started with KEY_INTENT must share Authenticator's signatures
            at com.android.server.accounts.AccountManagerService$Session.onResult(AccountManagerService.java:2580)
            at com.android.server.accounts.AccountManagerService$6.onResult(AccountManagerService.java:1677)
            at com.android.server.accounts.AccountManagerService$6.onResult(AccountManagerService.java:1652)
            at android.accounts.IAccountAuthenticatorResponse$Stub.onTransact(IAccountAuthenticatorResponse.java:59)

Apps 'C' and 'S' described above are unrelated, so they are signed with different certificates.

I am guessing the function should have worked in above scenario ( which is one of the main purpose of AccountManager - Sharing of account access tokens across apps ) as well ( with a security dialog thrown to the user on whether he should allow 'C' to access 'S' ) , whats the reason it is not working ? Am i missing anything here ?

Thanks

回答1:

  1. First go to your implementation of AbstractAuthenticator in app S. Find getAuthToken() implementation. Check, which activity you return as KEY_INTENT. It must be in same app as authenticator (yes, there are ways to launch an activity from another app).
  2. Make sure, you run on a real device, because you must see a "grant permissions" android system screen in that case.
  3. If you come here, than I don't know another reason except some bug. Try totally removing both apps and restarting emulator, then check if problem persists.