AccountManager.confirmCredentials issue

Question

I'm trying to use AccountManager.confirmCredentials method for user verification in my app. I'm using it like that:

    AccountManager am = AccountManager.get(ctx);
    am.confirmCredentials(account, null, ctx, new AccountManagerCallback<Bundle>() {
        @Override
        public void run(AccountManagerFuture<Bundle> amf) {
            try {
                Bundle b = amf.getResult();
                boolean r = b.getBoolean(AccountManager.KEY_BOOLEAN_RESULT);
                vc.onValidateResult(r);
                return;
            } catch (OperationCanceledException ignore) {
            } catch (AuthenticatorException ignore) {
            } catch (IOException ignore) {
            }
            vc.onValidateResult(false);
        }
    }, null);

But found a gap in its implementation since Android 5. A user can clear the proposed account name in the Google authorization form and use his/her own. The result will be positive, and there is no ability to verify if the requested account name was used for confirmation because the got bundle has only timestamp and resulting boolean value. In other words, the bundle doesn't have KEY_ACCOUNT_NAME field, however, accordingly to the reference it should.

Does anyone know how to work around this breach?

Disinterested

Which API are you targetting? – Shaum

Zohaib Amir, 19+ – Disinterested

Did you add MANAGE_ACCOUNTS permission? – Shaum

Zohaib Amir, sure, I've added any permission related to accounts I found in Android. No effect. – Disinterested

Answer 1

It's already fixed by Google. Now works like expected without code changes.

Disinterested

Answer 2

According to documentation:

If no activity or password was specified, the returned Bundle contains KEY_INTENT with the Intent needed to launch the password prompt. Also the returning Bundle may contain KEY_LAST_AUTHENTICATED_TIME indicating the last time the credential was validated/created.

If your result does not contain Account Name, then it must be due to above scenario. You should check if the intent contains KEY_INTENT and if it does then launch that intent to verify.

Shaum

I checked both cases, with activity and intent. Unfortunately, none of them provides an account name, only a result and last authenticated time. – Disinterested

@Disinterested so you are not getting name in any case? – Shaum

Zohaib Amir, correct. I'm not getting a name in any case. – Disinterested

@Disinterested is the behavior same on all devices or specific versions only? – Shaum

Zohaib Amir, I checked on API > 19 emulators and Samsung S8 (Pie) device. Everywhere the same. I believe it's Google Play services issue because AOSP doesn't have code related to Google accounts authentication in this way. – Disinterested

@Disinterested did you debug bundle to see which keys it contains? – Shaum

Zohaib Amir, sure I did – Disinterested

Let us continue this discussion in chat. – Disinterested

@Disinterested How did you solve this issue? I am facing the same issue – Taliped

@Bug Hunter 219, Google fixed that approx 6 months ago. Please update Google Play Services, it should help. – Disinterested