Support work account creation through device policy controller #2521
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Verify that work accounts are only added by device owners or profile owners. For instance, Microsoft Intune will create a work profile (moving itself to the work profile in the process) before using the work account servce to create a work account, so at that point it will already be profile owner. Apps that are not the profile owner will subsequently not be able to disable the work account authenticator or remove the work account. The personal account would not have an owner and thus no application could enable the work account provider there.
|
The files |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Implements a work account service API that is used by Device Policy Controller apps through the proprietary DPC support library.
Only device / profile owners are allowed to use this API (GMS instead uses an allowlist). The DPC support library will use the API to enable the work account authenticator component, making the option to add a "Managed Google for Work account" visible in the Accounts screen for the work profile. However, the account cannot be created manually. Instead, it can only be created by admin apps / the DPC app which can create a token for this purpose.
This token is used to sign in to the managed work account. Like on GMS, the account will have a name like
work-25[…][email protected].This managed work account should allow access to a scoped version of the Google Play store, but is not used at all as-is. As of now, it is not possible for a user to download any apps to the work profile if the policy controller does not install any app store other than Google Play to the profile.