Unset StrongAuthFlags when unlocking a user profile
Currently the full user (e.g. userId 0) is required to enter device credential (e.g. device PIN/pattern/password) to unlock the device in certain cases as specified by StrongAuthFlags (e.g. the user has triggered lockdown). After successfully verify the device credential, StrongAuthFlags for the full user will be set back to STRONG_AUTH_NOT_REQUIRED. This may or may not clear StrongAuthFlags for a profile of the user, depending on whether the profile has a separate or unified lock. Case #1: the profile has a seprate lock. In this case, the user will need to enter the device credential on lockscreen to unlock the device, and then enter the different profile lock to unlock the profile. StrongAuthFlags for the profile will only be cleared after successfully verifying the profile lock. Case #2: the profile has a unified lock. Currently in this case, StrongAuthFlags for the profile doesn't get cleared properly after the user verifies the device credential on lockscreen and unpauses the profile. For example, if the user triggers lockdown and later enters the device credential to unlock the device, StrongAuthFlags for the full user gets cleared (so the full user exits lockdown) while StrongAuthFlags for the profile doesn't get cleared (so the profile remains in lockdown), and thus notifications for the profile won't be shown properly. This CL fixes the issue above for the case #2. The user will only need to enter the device credential on lockscreen once to unlock the device. If the profile is already unpaused, at this point StrongAuthFlags should already be cleared; otherwise, StrongAuthFlags will be cleared after the user unpauses the profile (but without having to enter any lock again since the profile uses a unified lock). Test: (1) Set up a profile (e.g. a managed profile) with a unified lock. (2) Trigger the lockdown mode on lockscreen, and verify that StrongAuthFlags for the full user and the profile are both set properly, via "adb shell dumpsys lock_settings". (3) Enter the device credential on lockscreen for the full user, and verify that StrongAuthFlags for the full user is unset. StrongAuthFlags for the profile should also be cleared at this point if the profile was unpaused already before lockdown; otherwise (4) Unpause the profile and verify that StrongAuthFlags for the profile is cleared. Fix: 176924824 Bug: 173721373 Change-Id: Ic466fc22a5be9047d39194ad42c56dc4a2acb4dc
Loading
Please register or sign in to comment