UCM default behavior is to allow whitelisted application(s) to access Credential Storage when device is locked. But authentication type is configured as UCM_AUTH_TYPE_LOCKED, application(s) cannot access Credential Storage when device is locked. In this case, Configurator can use this API to exempt application(s) to allow to access Credential storage even if device is locked.
This is required in case an application (running in background) need access to certificates when the device/container is locked or user is not expected to enter password. e.g - 3rd party VPN application which needs access to certificates without user interaction.
Valid exempt type is UCM_EXEMPT_TYPE_AUTH.
Note: Configurator application should use WIFI_VIRTUAL_PACKAGE package to exempt WIFI.
Note: Application signature is optional. It is recommended to send application signature for security purpose.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
 
   Listlist = new ArrayList();
   AppIdentity pkg = new AppIdentity();
   pkg.setPackageName("com.android.myapplication");
   list.add(pkg);
 
   // allow WIFI
   AppIdentity wifi = new AppIdentity();
   wifi.setPackageName(WIFI_VIRTUAL_PACKAGE);
   list.add(wifi);
 
   int result = ucmMgr.addPackagesToExemptList(cs, UCM_EXEMPT_TYPE_AUTH, list);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
 
   Listlist = new ArrayList();
   AppIdentity pkg = new AppIdentity();
   pkg.setPackageName("com.android.myapplication");
   list.add(pkg);

   int result = ucmMgr.addPackagesToExemptList(cs, UCM_EXEMPT_TYPE_AUTH, list);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to whitelist application(s) to use Credential storage or access the Certificate stored inside Credential Storage.
There are two type of whitelist to access storage and access certificate stored inside Credential Storage.
So the application should be included in these two whitelist to access certificates. Configurator can use the wild character "*" to whitelist all applications to use Credential storage or access the Certificate.

Note: Application signature is mandatory.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
 
   Listlist = new ArrayList();
   String sig = "xxxxxxxx"; // signature of application
   AppIdentity pkg = new AppIdentity("com.android.myapplication", sig);
   list.add(pkg);
  
   // Whitelist application to access storage
   Bundle data = new Bundle();
   data.putInt(BUNDLE_EXTRA_ACCESS_TYPE, UCM_ACCESS_TYPE_STORAGE);
   int result = ucmMgr.addPackagesToWhiteList(cs, list, data);
   // Whitelist application to access Certificate stored inside Credential Storage.
   data = new Bundle();
   data.putInt(BUNDLE_EXTRA_ACCESS_TYPE, UCM_ACCESS_TYPE_CERTIFICATE);
   data.putString(BUNDLE_EXTRA_ALIAS, "test");
   result = ucmMgr.addPackagesToWhiteList(cs, list, data);
 } catch (SecurityException e) {
    Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
 
   Listlist = new ArrayList();
   String sig = "xxxxxxxx"; // signature of application
   AppIdentity pkg = new AppIdentity("com.android.myapplication", sig);
   list.add(pkg);
 
   // Whitelist application to access storage
   Bundle data = new Bundle();
   data.putInt(BUNDLE_EXTRA_ACCESS_TYPE, UCM_ACCESS_TYPE_STORAGE);
   int result = ucmMgr.addPackagesToWhiteList(cs, list, data);
   // Whitelist application to access Certificate stored inside Credential Storage.
   data = new Bundle();
   data.putInt(BUNDLE_EXTRA_ACCESS_TYPE, UCM_ACCESS_TYPE_CERTIFICATE);
   data.putString(BUNDLE_EXTRA_ALIAS, "alias_name");
   result = ucmMgr.addPackagesToWhiteList(cs, list, data);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to change KeyguardPIN.
When user wants changes PIN, user runs Activity and runs this API
Configurator has to be active administrator to call this API.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   int result = ucmMgr.changeKeyguardPin(cs, currentPin, newPin);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   int result = ucmMgr.changeKeyguardPin(cs, currentPin, newPin);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to clear whitelisted application(s) which are allowed to use Credential storage or access Certificate stored in Credential storage.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";

   // Clear whitelisted application which is allowed to access storage
   Bundle data = new Bundle();
   data.putInt(BUNDLE_EXTRA_ACCESS_TYPE, UCM_ACCESS_TYPE_STORAGE);
   int result = ucmMgr.clearWhiteList(cs, data);

   // Clear whitelisted application which is allowed to access Certificate stored inside Credential Storage
   data = new Bundle();
   data.putInt(BUNDLE_EXTRA_ACCESS_TYPE, UCM_ACCESS_TYPE_CERTIFICATE);
   data.putString(BUNDLE_EXTRA_ALIAS, "alias_name");
   result = ucmMgr.clearWhiteList(cs, data);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";

   // Clear whitelisted application which is allowed to access storage
   Bundle data = new Bundle();
   data.putInt(BUNDLE_EXTRA_ACCESS_TYPE, UCM_ACCESS_TYPE_STORAGE);
   int result = ucmMgr.clearWhiteList(cs, data);

   // Clear whitelisted application which is allowed to access Certificate stored inside Credential Storage
   data = new Bundle();
   data.putInt(BUNDLE_EXTRA_ACCESS_TYPE, UCM_ACCESS_TYPE_CERTIFICATE);
   data.putString(BUNDLE_EXTRA_ALIAS, "alias_name");
   result = ucmMgr.clearWhiteList(cs, data);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to configure Credential Storage for ODE Settings. Credential Storage plugin with attribute "isODESupport = true" can be configured for ODE. Once configured then Credential Storage will be used for ODE configuration. If device is encrypted using UCM then Configurator application cannot set any new Credential Storage.
If device is encrypted using UCM yet then Configurator application which earlier set the Credential Storage can only remove the configured Credential Storage by passing null in the API.
Configurator has to be active administrator to call this API.

Note: This API is available in system user only.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   Bundle scpParam = new Bundle();
   int result = ucmMgr.configureCredentialStorageForODESettings(cs, scpParam);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to configure Credential storage plugin by passing Bundle data. Successful API call will return requestId.
Plugin can notify configure status to Configurator via ACTION_UCM_CONFIG_STATUS, and Configurator should match requestId received from API call with requestId received by intent to authenticate the plugin.

Note: Plugin vendor should share the bundle keys and values to Configurator and Configurator should know the keys to access data from bundle.
Note: requestId will always be > 10000 else it's an error.
@Since KNOX 3.10
Configurator should wait intent action ACTION_UCM_CONFIG_STATUS and extra data 'KEY_PLUGIN_EVENT' to get event 'applet install complete' or 'failed to install applet'.
Configurator should not call UCM function(ex. installCertificate) before receiving intent to notify 'install complete' or 'install failed'.

  private BroadcastReceiver mUcsReceiver = new BroadcastReceiver() {
    public void onReceive(Context context, Intent intent) {
      if (intent.getAction().equals(UniversalCredentialStorageManager.INTENT_UCSM_CONFIG_STATUS)) {
        if(intent.getExtras() != null) {
          Bundle data = intent.getExtras();
          if(data != null) {
            int requestId = data.getInt(UniversalCredentialStorageManager.BUNDLE_EXTRA_REQUEST_ID , 0);
            int statusCode = data.getInt(UniversalCredentialStorageManager.BUNDLE_EXTRA_STATUS_CODE, -1);
            int installStatus = data.getInt(UniversalCredentialStorageManager.KEY_PLUGIN_EVENT, -1);
            switch (installStatus) {
              case UniversalCredentialStorageManager.EVENT_PLUGIN_APPLET_INSTALL_COMPLETED:
              // install complete
              break;
              case UniversalCredentialStorageManager.EVENT_PLUGIN_APPLET_INSTALL_FAILED:
              // install failed
              break;
              case UniversalCredentialStorageManager.EVENT_PLUGIN_APPLET_DELETE_COMPLETED:
              // delete complete
              break;
              case UniversalCredentialStorageManager.EVENT_PLUGIN_APPLET_DELETE_FAILED:
              // delete faild
              break;
              case : -1
              default :
              // no data
            }
            if (installStatus != -1) {
              if (installStatus == UniversalCredentialStorageManager.EVENT_PLUGIN_APPLET_INSTALL_COMPLETED) {
                // install complete
              } else {
              }
            }
          }
        }
      }
    }
  };
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   Bundle data = new Bundle();
   data.putString("Plugin pre-shared key", "Plugin pre-shared value");
   int requestId = ucmMgr.configureCredentialStoragePlugin(cs, data);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   Bundle data = new Bundle();
   data.putString("Plugin pre-shared key", "Plugin pre-shared value");
   int requestId = ucmMgr.configureCredentialStoragePlugin(cs, data);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to delete CA certificate.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   int result = ucmMgr.deleteCACertificate(alias);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   int result = ucmMgr.deleteCACertificate(alias);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to delete certificate from Credential storage.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";

   String alias = "alias_name";
   int result = ucmMgr.deleteCertificate(cs, alias);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";

   String alias = "alias_name";
   int result = ucmMgr.deleteCertificate(cs, alias);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to enforce the Credential storage as only Lock Type.
If one Configurator set the Credential Storage Lock type for a user, then other admin cannot override it for the same user.
Even if this API is called, user still can use current lock type before UCM keyguard is enabled. But UCM keyguard is enabled once, user cannot change the lock type.
After Configurator revokes this policy, user can change the lock type. Configurator should pass Credential Storage object as null to revoke its policy.
Configurator has to be active administrator to call this API.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   int result = ucmMgr.enforceCredentialStorageAsLockType(cs);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   int result = ucmMgr.enforceCredentialStorageAsLockType(cs);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to enforce the Credential storage as only Lock Type.
If one Configurator set the Credential Storage Lock type for a user, then other admin cannot override it for the same user.
Even if this API is called, user still can use current lock type before UCM keyguard is enabled. But UCM keyguard is enabled once, user cannot change the lock type.
After Configurator revokes this policy, user can change the lock type. Configurator should pass Credential Storage object as null to revoke its policy.
Configurator has to be active administrator to call this API.

Note: If BUNDLE_EXTRA_ENFORCE_LOCK_TYPE_DIRECT_SET is true in bundle input parameter, lock type settings is shown directly.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   Bundle options = new Bundle();
   options.putBoolean(UniversalCredentialManager.BUNDLE_EXTRA_ENFORCE_LOCK_TYPE_DIRECT_SET, true);
   int result = ucmMgr.enforceCredentialStorageAsLockType(cs, options);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   Bundle options = new Bundle();
   options.putBoolean(UniversalCredentialManager.BUNDLE_EXTRA_ENFORCE_LOCK_TYPE_DIRECT_SET, true);
   int result = ucmMgr.enforceCredentialStorageAsLockType(cs, options);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to get all the aliases related to Credential storage.

Note: Certificate aliases will be returned which are only installed by Configurator.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";

   String[] aliases = ucmMgr.getAliases(cs);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";

   String[] aliases = ucmMgr.getAliases(cs);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to get Authentication type for Credential storage.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";

   int type = ucmMgr.getAuthType(cs);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";

   int type = ucmMgr.getAuthType(cs);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to get the list of all available storages on device.

Note: Currently this API returns all the UCM plugin(s) installed in system user only.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage[] storages = ucmMgr.getAvailableCredentialStorages();
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage[] storages = ucmMgr.getAvailableCredentialStorages();
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to get CA certificate.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CACertificateInfo result = ucmMgr.getCACertificate(alias);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CACertificateInfo result = ucmMgr.getCACertificate(alias);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to get CA certificate aliases.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   Bundle options = new Bundle();
   String[] result = ucmMgr.getCACertificateAliases(options);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   Bundle options = new Bundle();
   String[] result = ucmMgr.getCACertificateAliases(options);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to get Credential storage plugin configuration.

Note: Plugin vendor should share the bundle keys and values to Configurator and Configurator should know the keys to access data from bundle.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   Bundle data = ucmMgr.getCredentialStoragePluginConfiguration(cs);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   Bundle data = ucmMgr.getCredentialStoragePluginConfiguration(cs);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to get data from plugin.
If Configurator configured properties using setCredentialStorageProperty, Configurator can get applied properties using this API.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";

   Bundle option = ucmMgr.getCredentialStorageProperty(cs, null);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";

   Bundle option = ucmMgr.getCredentialStorageProperty(cs, null);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to get all the Credential Storages which can be accessed by a package.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage[] storages = ucmMgr.getCredentialStorages("com.test");
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage[] storages = ucmMgr.getCredentialStorages("com.test");
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to get the Credential storage which is enforced as Lock type.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage storage = ucmMgr.getEnforcedCredentialStorageForLockType();
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage storage = ucmMgr.getEnforcedCredentialStorageForLockType();
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to get current retrycount of KeyguardPIN.
When user changes PIN, user should ckeck this condition. If retrycount be 0, device will be locked.
Configurator has to be active administrator to call this API.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   int result = ucmMgr.getCurrentKeyguardPinRetryCount(cs);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   int result = ucmMgr.getCurrentKeyguardPinRetryCount(cs);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to get condition about length of PIN.
When user changes PIN, user should follow this condition about minimumPinLength, maximumPinLength
Configurator has to be active administrator to call this API.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   int result = ucmMgr.getKeyguardPinMaximumLength(cs);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   int result = ucmMgr.getKeyguardPinMaximumLength(cs);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to get retrycount of KeyguardPIN.
When user changes PIN, user should ckeck this condition. If retrycount be 0, device will be locked.
Configurator has to be active administrator to call this API.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   int result = ucmMgr.getKeyguardPinMaximumRetryCount(cs);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   int result = ucmMgr.getKeyguardPinMaximumRetryCount(cs);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to get condition about length of PIN.
When user changes PIN, user should follow this condition about minimumPinLength, maximumPinLength
Configurator has to be active administrator to call this API.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   int result = ucmMgr.getKeyguardPinMinimumLength(cs);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   int result = ucmMgr.getKeyguardPinMinimumLength(cs);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to get ODE configuration settings.

Note: This API is available in system user only.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   Bundle result = ucmMgr.getODESettingsConfiguration();
   String agentId = result.getString(UniversalCredentialUtil.AGENT_ID, "");
   byte[] pluginSignature = result.getByteArray(UniversalCredentialUtil.ODE_SIGNATURE);
   boolean encrypted = result.getBoolean(UniversalCredentialUtil.ODE_ENABLED, false);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to get the exempt application(s) related to Credential storage.
Valid exempt type is UCM_EXEMPT_TYPE_AUTH.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";

   List apps = ucmMgr.getPackagesFromExemptList(cs, UCM_EXEMPT_TYPE_AUTH);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";

   List apps = ucmMgr.getPackagesFromExemptList(cs, UCM_EXEMPT_TYPE_AUTH);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to get all whitelisted application(s) which are allowed to use Credential storage or access Certificate stored in Credential storage.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";

   // Get all the whitelisted application(s) which are allowed to access storage
   Bundle data = new Bundle();
   data.putInt(BUNDLE_EXTRA_ACCESS_TYPE, UCM_ACCESS_TYPE_STORAGE);
   List list = ucmMgr.getPackagesFromWhiteList(cs, data);

   // Get all the whitelisted application(s) which are allowed to access Certificate stored inside Credential Storage.
   data = new Bundle();
   data.putInt(BUNDLE_EXTRA_ACCESS_TYPE, UCM_ACCESS_TYPE_CERTIFICATE);
   data.putString(BUNDLE_EXTRA_ALIAS, "alias_name");
   list = ucmMgr.getPackagesFromWhiteList(cs, data);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";

   // Get all the whitelisted application(s) which are allowed to access storage
   Bundle data = new Bundle();
   data.putInt(BUNDLE_EXTRA_ACCESS_TYPE, UCM_ACCESS_TYPE_STORAGE);
   List list = ucmMgr.getPackagesFromWhiteList(cs, data);

   // Get all the whitelisted application(s) which are allowed to access Certificate stored inside Credential Storage.
   data = new Bundle();
   data.putInt(BUNDLE_EXTRA_ACCESS_TYPE, UCM_ACCESS_TYPE_CERTIFICATE);
   data.putString(BUNDLE_EXTRA_ALIAS, "alias_name");
   list = ucmMgr.getPackagesFromWhiteList(cs, data);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to get all the supported algorithms related to Credential storage.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";

   String[] algorithms = ucmMgr.getSupportedAlgorithms(cs);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";

   String[] algorithms = ucmMgr.getSupportedAlgorithms(cs);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

API to get UniversalCredentialManager instance.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 

API to get UniversalCredentialManager instance.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 

Configurator can use this API to initialize KeyguardPIN.
This api has a relationship with setKeyguardPinMinimumLength(CredentialStorage, int), setKeyguardPinMaximumLength(CredentialStorage, int)
Configurator has to be active administrator to call this API.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   Bundle options = new Bundle();
   int result = ucmMgr.initKeyguardPin(cs, newPin, options);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   Bundle options = new Bundle();
   int result = ucmMgr.initKeyguardPin(cs, newPin, options);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to install certificate for SCP communication.

Note: Configurator should pass BUNDLE_EXTRA_ODE_CA_CERT equals true if CA certificate is for ODE configuration.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   File objFile = new File("/mnt/sdcard/cacert.der");
   byte object_buffer[] = new byte[(int) objFile.length()];
   FileInputStream fs = new FileInputStream(objFile);
   fs.read(object_buffer);
   fs.close();

   String alias = "ca_cert";
   Bundle options = new Bundle();
   options.putString(UniversalCredentialManager.BUNDLE_CA_CERT_TYPE, UniversalCredentialManager.SCP_SD);
   options.putBoolean(UniversalCredentialManager.BUNDLE_EXTRA_ODE_CA_CERT, false);
   int result = ucmMgr.installCACertificate(object_buffer, alias, options);
 
   // CA certificate for ode
   alias = "ca_cert_ode";
   options = new Bundle();
   options.putString(UniversalCredentialManager.BUNDLE_CA_CERT_TYPE, UniversalCredentialManager.SCP_SD);
   options.putBoolean(UniversalCredentialManager.BUNDLE_EXTRA_ODE_CA_CERT, true);
   result = ucmMgr.installCACertificate(object_buffer, alias, options);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   File objFile = new File("/mnt/sdcard/cacert.der");
   byte object_buffer[] = new byte[(int) objFile.length()];
   FileInputStream fs = new FileInputStream(objFile);
   fs.read(object_buffer);
   fs.close();

   String alias = "ca_cert";
   Bundle options = new Bundle();
   options.putString(UniversalCredentialManager.BUNDLE_CA_CERT_TYPE, UniversalCredentialManager.SCP_SD);
   options.putBoolean(UniversalCredentialManager.BUNDLE_EXTRA_ODE_CA_CERT, false);
   int result = ucmMgr.installCACertificate(object_buffer, alias, options);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to install certificate in Credential storage.

Note: BUNDLE_EXTRA_ALLOW_WIFI is Deprecated in API level 35.
Note: Wifi certificate is allowed to be install in user 0 only. Wifi certificate will avaiable in Setting app-> Wifi profile screen without explict whitelisting.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
 
   File objFile = new File("/mnt/sdcard/cert.pem");
   byte object_buffer[] = new byte[(int) objFile.length()];
   FileInputStream fs = new FileInputStream(objFile);
   fs.read(object_buffer);
   fs.close();
 
   String alias = "alias_name";
   String certPwd = "1234";
   Bundle options = new Bundle();
 
   // Note : BUNDLE_EXTRA_ALLOW_WIFI is deprecated in API level 35.
   // To install wifi certificate
   //options.putBoolean(BUNDLE_EXTRA_ALLOW_WIFI, true);
   //int result = ucmMgr.installCertificate(cs, object_buffer, alias, certPwd, options);
  
   // To install non wifi certificate.
   //options.putBoolean(BUNDLE_EXTRA_ALLOW_WIFI, false); // This is optional.  default value is false.
   result = ucmMgr.installCertificate(cs, object_buffer, alias, certPwd, options);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
 
   File objFile = new File("/mnt/sdcard/cert.pem");
   byte object_buffer[] = new byte[(int) objFile.length()];
   FileInputStream fs = new FileInputStream(objFile);
   fs.read(object_buffer);
   fs.close();
 
   String alias = "alias_name";
   String certPwd = "1234";
   Bundle options = new Bundle();
 
   // To install non wifi certificate
   //options.putBoolean(BUNDLE_EXTRA_ALLOW_WIFI, false); // This is optional. default value is false.
   result = ucmMgr.installCertificate(cs, object_buffer, alias, certPwd, options);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to check whether Credential Storage is managed by calling Configurator.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   boolean status = ucmMgr.isCredentialStorageManaged(cs);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   boolean status = ucmMgr.isCredentialStorageManaged(cs);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to manage or unmanage Credential Storage. Configurator should manage Credential Storage before it calls other management API's except getAvailableCredentialStorages() API.
And Credential Storage can be managed by multiple Configurators separately.
Once Credential Storage is unmanaged by then all the data configuraed by calling Configurator to the Credential Storage i.e whitelist, certificate etc will be removed and an event is triggered to plugin to cleanup it's data.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   // manage Credential Storage
   int result = ucmMgr.manageCredentialStorage(cs, true);
   // unmanage Credential Storage
   result = ucmMgr.manageCredentialStorage(cs, false);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   // manage Credential Storage
   int result = ucmMgr.manageCredentialStorage(cs, true);
   // unmanage Credential Storage
   result = ucmMgr.manageCredentialStorage(cs, false);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to remove exempt application(s) related to Credential storage.
If app list is passed as null then all exempted list will be cleared.
Valid exempt type is UCM_EXEMPT_TYPE_AUTH.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
 
   Listlist = new ArrayList();
   AppIdentity pkg = new AppIdentity();
   pkg.setPackageName("com.android.myapplication");
   list.add(pkg);

   int result = ucmMgr.removePackagesFromExemptList(cs, UCM_EXEMPT_TYPE_AUTH, list);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
 
   Listlist = new ArrayList();
   AppIdentity pkg = new AppIdentity();
   pkg.setPackageName("com.android.myapplication");
   list.add(pkg);

   int result = ucmMgr.removePackagesFromExemptList(cs, UCM_EXEMPT_TYPE_AUTH, list);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to remove whitelisted application(s) which are allowed to use Credential storage or access Certificate stored in Credential Storage.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
 
   Listlist = new ArrayList();
   AppIdentity pkg = new AppIdentity();
   pkg.setPackageName("com.android.myapplication");
   list.add(pkg);

   // Remove whitelisted application which is allowed to access storage
   Bundle data = new Bundle();
   data.putInt(BUNDLE_EXTRA_ACCESS_TYPE, UCM_ACCESS_TYPE_STORAGE);
   int result = ucmMgr.removePackagesFromWhiteList(cs, list, data);

   // Remove whitelisted application which is allowed to access Certificate stored inside Credential Storage
   data = new Bundle();
   data.putInt(BUNDLE_EXTRA_ACCESS_TYPE, UCM_ACCESS_TYPE_CERTIFICATE);
   data.putString(BUNDLE_EXTRA_ALIAS, "alias_name" )
   result = ucmMgr.removePackagesFromWhiteList(cs, list, data);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
 
   Listlist = new ArrayList();
   AppIdentity pkg = new AppIdentity();
   pkg.setPackageName("com.android.myapplication");
   list.add(pkg);

   // Remove whitelisted application which is allowed to access storage
   Bundle data = new Bundle();
   data.putInt(BUNDLE_EXTRA_ACCESS_TYPE, UCM_ACCESS_TYPE_STORAGE);
   int result = ucmMgr.removePackagesFromWhiteList(cs, list, data);

   // Remove whitelisted application which is allowed to access Certificate stored inside Credential Storage
   data = new Bundle();
   data.putInt(BUNDLE_EXTRA_ACCESS_TYPE, UCM_ACCESS_TYPE_CERTIFICATE);
   data.putString(BUNDLE_EXTRA_ALIAS, "alias_name" )
   result = ucmMgr.removePackagesFromWhiteList(cs, list, data);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to set Authentication type for Credential storage. Configurator can use UCM_AUTH_TYPE_LOCKED or UCM_AUTH_TYPE_NONE.
If UCM_AUTH_TYPE_LOCKED is set then no application can access the Credential storage when device/container is locked. If UCM_AUTH_TYPE_NONE is set then application can access the Credential storage at any time.
By default UCM_AUTH_TYPE_NONE is enforced on Credential storage.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";

   int status = ucmMgr.setAuthType(cs, UCM_AUTH_TYPE_LOCKED);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";

   int status = ucmMgr.setAuthType(cs, UCM_AUTH_TYPE_LOCKED);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

An configurator can use this API to send properties to Credential Storage. This api depends on the implementation of plugin.
For example, UCM framework defines BUNDLE_EXTRA_PIN_CACHE, BUNDLE_EXTRA_PIN_CACHE_TIMEOUT_MINUTES, BUNDLE_EXTRA_ADD_PIN_CACHE_EXEMPTLIST to configure pin cache option.
If plugin handles this options, Configurator can configure pin cache option. But it is not madatory.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
 
   // Cache pin till keyguard timeout
   Bundle data = new Bundle();
   data.putInt(BUNDLE_EXTRA_PIN_CACHE, PIN_CACHE_KEYGUARD_TIMEOUT);
   Bundle result = ucmMgr.setCredentialStorageProperty(cs, data);
 
   // Cache pin till timeout
   data = new Bundle();
   data.putInt(BUNDLE_EXTRA_PIN_CACHE, PIN_CACHE_TIMEOUT);
   data.putInt(BUNDLE_EXTRA_PIN_CACHE_TIMEOUT_MINUTES, 10);
   result = ucmMgr.setCredentialStorageProperty(cs, data);
 
   //Allow packages to access Credential storage in the background even after pin caching timeout.
   List pkgs = new Arraylist();
   pkgs.add("com.android.myapplication");
   data = new Bundle();
   data.putStringArrayList(BUNDLE_EXTRA_ADD_PIN_CACHE_EXEMPTLIST, pkgs));
   result = ucmMgr.setCredentialStorageProperty(cs, data);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
 
   // Cache pin till keyguard timeout
   Bundle data = new Bundle();
   data.putInt(BUNDLE_EXTRA_PIN_CACHE, PIN_CACHE_KEYGUARD_TIMEOUT);
   Bundle result = ucmMgr.setCredentialStorageProperty(cs, data);
 
   // Cache pin till timeout
   data = new Bundle();
   data.putInt(BUNDLE_EXTRA_PIN_CACHE, PIN_CACHE_TIMEOUT);
   data.putInt(BUNDLE_EXTRA_PIN_CACHE_TIMEOUT_MINUTES, 10);
   result = ucmMgr.setCredentialStorageProperty(cs, data);
 
   //Allow packages to access Credential storage in the background even after pin caching timeout.
   List pkgs = new Arraylist();
   pkgs.add("com.android.myapplication");
   data = new Bundle();
   data.putStringArrayList(BUNDLE_EXTRA_ADD_PIN_CACHE_EXEMPTLIST, pkgs));
   result = ucmMgr.setCredentialStorageProperty(cs, data);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to set condition about length of PIN.
When user changes PIN, user should follow this condition about minimumPinLength, maximumPinLength
Configurator has to be active administrator to call this API.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   int result = ucmMgr.setKeyguardPinMaximumLength(cs, maximumPinLength);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   int result = ucmMgr.setKeyguardPinMaximumLength(cs, maximumPinLength);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to set maximum retry count of Credential Storage Keyguard..

Configurator has to be active administrator to call this API.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   int result = ucmMgr.setKeyguardPinMaximumRetryCount(cs, retryCount);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   int result = ucmMgr.setKeyguardPinMaximumRetryCount(cs, retryCount);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Configurator can use this API to set condition about length of PIN.
When user changes PIN, user should follow this condition about minimumPinLength, maximumPinLength
Configurator has to be active administrator to call this API.

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   int result = ucmMgr.setKeyguardPinMinimumLength(cs, minimumPinLength);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

 UniversalCredentialManager ucmMgr = UniversalCredentialManager.getUCMManager(mContext, containerID);
 
 try {
   CredentialStorage cs = new CredentialStorage();
   cs.name = "Vendor Credential Storage Name";
   cs.packageName = "com.mycompany.ucm.plugin";
   int result = ucmMgr.setKeyguardPinMinimumLength(cs, minimumPinLength);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }