An application can use this API to send APDU command to applet. Calling application should send correct command which Applet can process. Plugin will return response in Bundle which can use one or more Bundle keys : PLUGIN_ERROR_CODE, PLUGIN_BOOLEAN_RESPONSE,PLUGIN_BUNDLE_RESPONSE,PLUGIN_BYTEARRAY_RESPONSE,PLUGIN_INT_RESPONSE, ,PLUGIN_STRINGARRAY_RESPONSE ,PLUGIN_STRING_RESPONSE.

 UniversalCredentialUtil ucmUtil = UniversalCredentialUtil.getInstance();
 
 try {
   String ucmUri = ucmUtil.getKeychainUri("Vendor Credential Storage Name", "");
   Bundle pluginData = ucmUtil.APDUCommand(ucmUri, byte, bundle);
   int errorCode = pluginData.getInt(PLUGIN_ERROR_CODE);
   byte[] response = pluginData.getByteArray(PLUGIN_BYTEARRAY_RESPONSE);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

An application can use this API to change applet pin. Plugin will return response in Bundle which can use one or more Bundle keys : PLUGIN_ERROR_CODE, PLUGIN_BOOLEAN_RESPONSE, PLUGIN_BUNDLE_RESPONSE, PLUGIN_BYTEARRAY_RESPONSE, PLUGIN_INT_RESPONSE, , PLUGIN_STRINGARRAY_RESPONSE , PLUGIN_STRING_RESPONSE.

 UniversalCredentialUtil ucmUtil = UniversalCredentialUtil.getInstance();
 
 try {
   String ucmUri = ucmUtil.getKeychainUri("Vendor Credential Storage Name", "");
   Bundle response = ucmUtil.changePin(ucmUri, "1234", "5678");
   int errorCode = pluginData.getInt(PLUGIN_ERROR_CODE);
   boolean status = pluginData.getBoolean(PLUGIN_BOOLEAN_RESPONSE);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

An application can use this API to get information from plugin/applet. Plugin will return response in Bundle which can use one or more Bundle keys : PLUGIN_ERROR_CODE, PLUGIN_BOOLEAN_RESPONSE,PLUGIN_BUNDLE_RESPONSE,PLUGIN_BYTEARRAY_RESPONSE,PLUGIN_INT_RESPONSE, ,PLUGIN_STRINGARRAY_RESPONSE ,PLUGIN_STRING_RESPONSE.

 UniversalCredentialUtil ucmUtil = UniversalCredentialUtil.getInstance();
 
 try {
   String ucmUri = ucmUtil.getKeychainUri("Vendor Credential Storage Name", "");
   Bundle response = ucmUtil.getInfo(ucmUri);
   int errorCode = pluginData.getInt(PLUGIN_ERROR_CODE);
   String data = pluginData.getString(PLUGIN_STRING_RESPONSE);
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

Retrieve URI string that representing the credential storage and its resource from keychain. The return URI will be in format ("ucmkeychain://version/SOURCE/ResourceId/UID/ALIAS").
version represent UCM URI version and ResourceId represent Certificate type e.g Keychain, WIFI etc.

Retrieve available UCM Plugin KeyStore Providers. Will return the list of available UCM Plugin backend Providers that can be used as keystore. Caller need to add the required KeyStore Provider into the Java Security Infrastructure before usage. To use the UCM Plugin KeyStore backend, provide the Keystore type as "KNOX" and if there is multiple UCM Plugin KeyStore backend being used, need to provide the Provider name.

 UniversalCredentialUtil ucmUtil = UniversalCredentialUtil.getInstance();
 Provider[] providers = ucmUtil.getProviders();
 
 for (Provider provider: providers) {
   String providerName = provider.getName();
   if (!providerName.contains("Vendor Credential Storage Name")) {
     continue;
   }

   Log.d(TAG, "providername = " + providerName);
   Log.d(TAG, "AGENT_ID = " + provider.getProperty(UniversalCredentialUtil.AGENT_ID));
   Log.d(TAG, "AGENT_SUMMARY = " + provider.getProperty(UniversalCredentialUtil.AGENT_SUMMARY));
   Log.d(TAG, "AGENT_TITLE = " + provider.getProperty(UniversalCredentialUtil.AGENT_TITLE));
   Log.d(TAG, "AGENT_VENDORID = " + provider.getProperty(UniversalCredentialUtil.AGENT_VENDORID));
   Log.d(TAG, "AGENT_PACKAGENAME = " + provider.getProperty(UniversalCredentialUtil.AGENT_PACKAGENAME));
   Log.d(TAG, "AGENT_IS_GENERATE_PASSWORD_AVAILABLE = " + provider.getProperty(UniversalCredentialUtil.AGENT_IS_GENERATE_PASSWORD_AVAILABLE));
   Log.d(TAG, "AGENT_IS_PUK_SUPPORTED = " + provider.getProperty(UniversalCredentialUtil.AGENT_IS_PUK_SUPPORTED));
 
   if (Security.getProvider(providerName) == null) {
     int result = Security.addProvider(provider);
     Log.d("providerName result= " + result);
   }
 
   try {
     KeyStore ks = KeyStore.getInstance("KNOX", providerName);
     ks.load(null);
   } catch(Exception e){
     Log.w(TAG, "Exception: " + e);
   }
 }
 

Retrieve the raw Alias name from the URI. UCM URI is in form of ucmkeychain://version/SOURCE/ResourceId/UID/ALIAS.
version represent UCM URI version and ResourceId represent Certificate type e.g Keychain, WIFI etc.

Retrieve the credential storage source identifier from the URI. UCM URI is in form of ucmkeychain://version/SOURCE/ResourceId/UID/ALIAS.
version represent UCM URI version and ResourceId represent Certificate type e.g Keychain, WIFI etc.

Check if the uri has valid URI scheme for UCM

Notify the results for the asynchronous API. And admin can receive results from Plugin. Only managed plugins can notify the results to the EMM.

 Bundle data = new Bundle();
 data.putInt(UcmAgentService.REQUEST_ID, requestId);
 data.putInt(UcmAgentService.ADMIN_UID, adminUid);
 data.putInt(UcmAgentService.STATUS_CODE, statusCode);
 data.putString("RESPONSE_DATA", responseCode);
 UniversalCredentialUtil ucmUtil = UniversalCredentialUtil.getInstance();
 ucmUtil.notifyPluginResult(data);
 

Until Knox 3.1, UCM plugin service should have plugin permission to be bound with UCM framework. So the plugin service need Knox license activation logic, and the plugin is bound after license activation.
But plugin service can be bound with UCM framework without plugin permission from Knox 3.2 device. Because of this license activation removal, Configurator or plugin application should call this API to trigger installed UCM plugin binding.
After all plugin binding is done, caller application can receive the completion intent from UCM framework.

 BroadcastReceiver mRefreshReceiver = new BroadcastReceiver() {
   public void onReceive(Context context, Intent intent) {
     Log.d(TAG, "Received : " + intent.getAction());
     if ("com.samsung.android.knox.intent.action.UCM_REFRESH_AGENT_DONE".equals(intent.getAction())) {
       Toast.makeText(getApplicationContext(), "Plugin refresh is done", Toast.LENGTH_LONG).show();
       Log.d(TAG, "Plugin refresh is done");
     }
   }
 };
 
 IntentFilter intentFilter = new IntentFilter(UniversalCredentialManager.ACTION_UCM_REFRESH_AGENT_DONE);
 registerReceiver(mRefreshReceiver, intentFilter);
 
 UniversalCredentialUtil ucmUtil = UniversalCredentialUtil.getInstance();
 ucmUtil.refreshUCMPlugin();