// Create Dual DAR with configuration bundle
 PersistableBundle adminExtras =  new PersistableBundle();
 adminExtras.putBoolean(DualDARPolicy.KEY_DUAL_DAR_CONFIG, true);
 adminExtras.putString(DualDARPolicy.KEY_CONFIG_CLIENT_PACKAGE, DUALDAR_CLIENT_EXAMPLE_PACKAGE_NAME);
 adminExtras.putString(DualDARPolicy.KEY_CONFIG_CLIENT_SIGNATURE, DUALDAR_CLIENT_EXAMPLE_PACKAGE_SHA256_SIGNATURE);

 // Set the file path of the client exist location adding with "file://" prefix.
 String DUALDAR_CLIENT_PACKAGE_DOWNLOAD_LOCATION = getExternalFilesDir(null) + "/client_example_app.apk";
 adminExtras.putString(DualDARPolicy.KEY_CONFIG_CLIENT_LOCATION, "file://" + DUALDAR_CLIENT_PACKAGE_DOWNLOAD_LOCATION);

 // Param field in admin extras bundle passed as DevicePolicyManager.EXTRA_PROVISIONING_ADMIN_EXTRAS_BUNDLE
 Intent intent = new Intent();
 if (adminExtras !=null && adminExtras.size() > 0) {
     intent.putExtra(DevicePolicyManager.EXTRA_PROVISIONING_ADMIN_EXTRAS_BUNDLE, adminExtras);
 }

 // Return DevicePolicyManager.PROVISIONING_MODE_MANAGED_PROFILE in DevicePolicyManager.EXTRA_PROVISIONING_MODE as result.
 intent.putExtra(DevicePolicyManager.EXTRA_PROVISIONING_MODE, DevicePolicyManager.PROVISIONING_MODE_MANAGED_PROFILE);
 // Since KNOX 3.8 DualDAR supports on DO Mode. The extra value needs to be replaced with PROVISIONING_MODE_FULLY_MANAGED_DEVICE.
 //intent.putExtra(DevicePolicyManager.EXTRA_PROVISIONING_MODE, DevicePolicyManager.PROVISIONING_MODE_FULLY_MANAGED_DEVICE);
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 DualDARPolicy dualDARPolicy = edm.getDualDARPolicy();
 try {
     boolean result = dualDARPolicy.clearResetPasswordTokenForInner();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 // When you create workspace(container) successfully, containerID will be returned via intent.
 // Use this containerID in below API.
 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
 DualDARPolicy dualDARPolicy = kcm.getDualDARPolicy();
 try {
     // get Dual DAR active config
     Bundle config = dualDARPolicy.getConfig();
     String clientPackage = config.getString(DualDARPolicy.KEY_CONFIG_CLIENT_PACKAGE);
     String clientSignature = config.getString(DualDARPolicy.KEY_CONFIG_CLIENT_SIGNATURE);
     long dataLockTimeout = config.getLong(DualDARPolicy.KEY_CONFIG_DATA_LOCK_TIMEOUT);
     boolean deRestriction = config.getBoolean(DualDARPolicy.KEY_CONFIG_DE_RESTRICTION);
     Parcelable[] parcelables = config.getParcelableArray(DualDARPolicy.KEY_CONFIG_WHITELISTED_DATA_LOCK_STATE_PACKAGES);
     AppIdentity[] datalockWhitelistedPackages = new AppIdentity[parcelables.length];
     for(int i=0;i<parcelables.length;i++) {
         datalockWhitelistedPackages[i] = (AppIdentity) parcelables[i];
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

Administrator can get the DualDAR version on the product.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 DualDARPolicy dualDARPolicy = edm.getDualDARPolicy();
 try {
     int length = dualDARPolicy.getPasswordMinimumLength();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e); 
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 DualDARPolicy dualDARPolicy = edm.getDualDARPolicy();
 try {
     boolean isSufficient = dualDARPolicy.isActivePasswordSufficientForInner();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e); 
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 DualDARPolicy dualDARPolicy = edm.getDualDARPolicy();
 try {
     boolean isActive = dualDARPolicy.isResetPasswordTokenActiveForInner();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 DualDARPolicy dualDARPolicy = edm.getDualDARPolicy();
 try {
     byte[] token = createToken();
     String newPassword = "test123";
     // Set token before reset password
     dualDARPolicy.setResetPasswordWithTokenForInner(token);
     // Set new password
     boolean result = dualDARPolicy.resetPasswordWithTokenForInner(password, token);
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 // When you create workspace(container) successfully, containerID will be returned via intent.
 // Use this containerID in below API.
 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
 DualDARPolicy dualDARPolicy = kcm.getDualDARPolicy();
 try {
     // set new Dual DAR config
     Bundle newConfig = new Bundle();
     newConfig.putBoolean(DualDARPolicy.KEY_CONFIG_DE_RESTRICTION, false);
     newConfig.putLong(DualDARPolicy.KEY_CONFIG_DATA_LOCK_TIMEOUT, 62000);

     List<AppIdentity> whitelistPackages = new ArrayList<>();
     whitelistPackages.add(new AppIdentity("com.test.app1","sign1"));
     whitelistPackages.add(new AppIdentity("com.test.app2","sign2"));
     newConfig.putParcelableArray(DualDARPolicy.KEY_CONFIG_WHITELISTED_DATA_LOCK_STATE_PACKAGES,
         (Parcelable[]) whitelistPackages.toArray(new AppIdentity[0]));

     newConfig.putBoolean(DualDARPolicy.KEY_CONFIG_DE_RESTRICTION, true);
     dualDARPolicy.setConfig(newConfig);
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

The device must be enrolled as DualDAR for fully managed devices in order to call this API, otherwise a Security Exception will be thrown.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 DualDARPolicy dualDARPolicy = edm.getDualDARPolicy();
 int minimumLength = 5;
 try {
     dualDARPolicy.setPasswordMinimumLengthForInner(minimumLength);
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e); 
 }
 

The device must be enrolled as DualDAR for fully managed devices in order to call this API, otherwise a Security Exception will be thrown.

NOTE : This token is highly sensitive and should be treated at the same level as user credentials. In particular, NEVER store this token on device in plaintext. Do not store the plaintext token in device-encrypted storage if it will be needed to reset password on file-based encryption devices before user unlocks. Consider carefully how any password token will be stored on your server and who will need access to them. Tokens may be the subject of legal access requests.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 DualDARPolicy dualDARPolicy = edm.getDualDARPolicy();
 try {
     // Generating a secure token
     byte[] generatedToken = createSecureToken();
     // Setting setResetPasswordTokenForInner with generated secure token
     boolean result = dualDARPolicy.setResetPasswordTokenForInner(generatedToken);
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }