API to process APDU command. Input APDU command is sent to plugin application, and plugin application can support APDU command directly without framework interface.
It can be called using APDUCommand(String, byte[], Bundle) API of UniversalCredentialUtil class, and calling application should know how to use APDU of the plugin application.

 public Bundle APDUCommand (byte[] apdu, Bundle extras) {
   //After processing the APDU command in an Applet.
   Bundle pluginResponse = new Bundle();
   pluginResponse.putByteArray(PLUGIN_BYTEARRAY_RESPONSE, applet_response);
   pluginResponse.putInt(PLUGIN_ERROR_CODE, ERROR_NONE);
   return pluginResponse;
  }
 

This API will be called to change PIN. It is not called in UCM framework side. It can be called using changePin(String, String, String) of UniversalCredentialUtil. After current PIN verification, the PIN value is change to entered new PIN.

 public Bundle changePin(String oldPin, String newPin) {
   Bundle pluginResponse = new Bundle();
   pluginResponse.putInt(PLUGIN_ERROR_CODE, ERROR_NONE);
   return pluginResponse;
 }
 

API to configure Storage plugin from Configurator app. Once API call is received then plugin application has to send below intent once configuration is completed with request Id to calling Configurator(adminUid). The request Id is created by UCM framework automatically.

 public Bundle configureCredentialStoragePlugin(int adminUid, Bundle data, int requestId) {
   // Start processing the data received from API and the reply to confirm that configuration request has been accepted.
   Bundle pluginResponse = new Bundle();
   pluginResponse.putInt(PLUGIN_INT_RESPONSE, 0);
   pluginResponse.putInt(PLUGIN_ERROR_CODE, ERROR_NONE);
   return pluginResponse;
 }
 

 private void notifyOperationResult(int adminUid, int requestId, int result) {
   // After completing sync or async operation in this API then notify to Configurator.
   Intent intent = new Intent(ACTION_UCM_PLUGIN_STATUS);
   Bundle data = new Bundle();
   data.putInt(REQUEST_ID, requestId);
   data.putInt(ADMIN_UID, adminUid);
   data.putInt(STATUS_CODE, result);
   intent.putExtras(data);
   getApplicationContext().sendBroadcast(intent);
 }
 

This API triggers device encryption key generation to Credential Storage, but the key is not retrieved by this API.
The generated device encryption key is retrieved when getDek() is called.
Basically this API can be called after PIN authentication.

 public Bundle generateDek() {
   Bundle pluginResponse = new Bundle();
   pluginResponse.putInt(PLUGIN_ERROR_CODE, ERROR_NONE);
   return pluginResponse;
 }
 

API to generate and return the password from Credential Storage. The password is used as keyguard password.
Basically this API can be called after PIN authentication.

 public Bundle generateKeyguardPassword(int userId, Bundle extras) {
   Bundle pluginResponse = new Bundle();
   String password = "PASSWORD";
   pluginResponse.putString(PLUGIN_BYTEARRAY_RESPONSE, password.getBytes());
   pluginResponse.putInt(PLUGIN_ERROR_CODE, ERROR_NONE);
   return pluginResponse;
 }
 

API to get wrapped device encryption key from Credential Storage. The wrapped key is stored in device side. But this key can be unwrapped by Credential Storage by unwrapDek(byte[]).
Basically this API can be called after PIN authentication.

 public Bundle generateWrappedDek() {
   Bundle pluginResponse = new Bundle();
   byte[] wrapped_dek = getWrappedDek();
   pluginResponse.putByteArray(PLUGIN_BYTEARRAY_RESPONSE, wrapped_dek);
   pluginResponse.putInt(PLUGIN_ERROR_CODE, ERROR_NONE);
   return pluginResponse;
 }
 

API to return Credential storage configuration. Plugin application can use one or more Bundle keys in response : PLUGIN_ERROR_CODE, PLUGIN_BOOLEAN_RESPONSE,PLUGIN_BUNDLE_RESPONSE,PLUGIN_BYTEARRAY_RESPONSE,PLUGIN_INT_RESPONSE, ,PLUGIN_STRINGARRAY_RESPONSE ,PLUGIN_STRING_RESPONSE.

 public Bundle getCredentialStoragePluginConfiguration(int adminUid) {
   Bundle pluginResponse = new Bundle();
   pluginResponse.putString(PLUGIN_STRING_RESPONSE, configuration);
   return pluginResponse;
 }
 

Some Credential Storage has each plugin specific properties like PIN timeout. Configurator can manage plugin properties using this API.
This API is used to get plugin specific properties.

 public Bundle getCredentialStorageProperty(int adminUid, String userId, Bundle extra) {
   Bundle properties = new Bundle();
   int pinCacheOption = PIN_CACHE_TIMEOUT;
   properties.putInt(BUNDLE_EXTRA_PIN_CACHE, pinCacheOption);
   return pluginResponse;
 }
 

API to get device encryption key from Credential Storage. The key is generated when generateDek() API is called.
Basically this API can be called after PIN authentication.

 public Bundle getDek() {
   Bundle pluginResponse = new Bundle();
   byte[] dek = getDek();
   pluginResponse.putByteArray(PLUGIN_BYTEARRAY_RESPONSE, dek);
   pluginResponse.putInt(PLUGIN_ERROR_CODE, ERROR_NONE);
   return pluginResponse;
 }
 

API to get detail error message for error code. Plugin application return detail error message will be shown to Keyguard or ODE UX.

 public String getDetailErrorMessage (int errorCode) {
     String errorMsg = null;
     if (errorCode == UcmAgentService.ERROR_NO_PLUGIN_RESPONSE) {
         errorMsg = "There is no plugin response";
     }
     return errorMsg;
 }
 

API to get Credential Storage information. This api depends on the implementation of plugin, plugin can use one or more Bundle keys in response : PLUGIN_ERROR_CODE, PLUGIN_BOOLEAN_RESPONSE, PLUGIN_BUNDLE_RESPONSE, PLUGIN_BYTEARRAY_RESPONSE, PLUGIN_INT_RESPONSE, , PLUGIN_STRINGARRAY_RESPONSE, PLUGIN_STRING_RESPONSE.
It can be called using getInfo(String) API of UniversalCredentialUtil class, and calling application should know pre-defined the key value of the plugin application to get return value.

 public Bundle getInfo() {
   //After processing in an Applet.
   Bundle pluginResponse = new Bundle();
   pluginResponse.putString(PLUGIN_STRING_RESPONSE, "information");
   pluginResponse.putInt(PLUGIN_ERROR_CODE, ERROR_NONE);
   return pluginResponse;
 }
 

This API will be called to get condition about current RetryCount. Whenever user inputs wrong pin, RetryCount is reduced. If retrycount is 0, CredentialStorage is blocked.

 public Bundle getKeyguardPinCurrentRetryCount() {
   Bundle pluginResponse = new Bundle();
   pluginResponse.putInt(PLUGIN_ERROR_CODE, ERROR_NONE);
   pluginResponse.putInt(PLUGIN_INT_RESPONSE, current_retrycount);
   return pluginResponse;
 }
 

This API will be called to set condition about PIN configuration. When user changes PIN, user should follow this condition about minimumPinLength, maximumPinLength.

 public Bundle getKeyguardPinMaximumLength() {
   Bundle pluginResponse = new Bundle();
   pluginResponse.putInt(PLUGIN_ERROR_CODE, ERROR_NONE);
   pluginResponse.putInt(PLUGIN_INT_RESPONSE, maximumPinLength);
   return pluginResponse;
 }
 

This API will be called to get condition about maximum RetryCount. Whenever user inputs wrong pin, RetryCount is reduced. If retrycount is 0, CredentialStorage is blocked.

 public Bundle getKeyguardPinMaximumRetryCount() {
   Bundle pluginResponse = new Bundle();
   pluginResponse.putInt(PLUGIN_ERROR_CODE, ERROR_NONE);
   pluginResponse.putInt(PLUGIN_INT_RESPONSE, maximum_retrycount);
   return pluginResponse;
 }
 

This API will be called to set condition about PIN configuration. When user changes PIN, user should follow this condition about minimumPinLength, maximumPinLength.

 public Bundle getKeyguardPinMinimumLength() {
   Bundle pluginResponse = new Bundle();
   pluginResponse.putInt(PLUGIN_ERROR_CODE, ERROR_NONE);
   pluginResponse.putInt(PLUGIN_INT_RESPONSE, minimumPinLength);
   return pluginResponse;
 }
 

API to get current UCM provider to register UCM SPI Service. Refer putServiceImpl(Provider.Service) API for it's usage.

API to get the current status of the Credential Storage, and the result should include these values that basic plugin error code and current lock state and remaining retry count.
If current lock state is STATE_BLOCKED, plugin can send more information string to display in Keyguard and ODE UI. It is MISC information and optional.
To send custom string, the string should be included into return bundle by MISC_INFO.

 public Bundle getStatus() {
   int remaining_count = 5;
   Bundle pluginResponse = new Bundle();
   pluginResponse.putInt(LOCK_STATE, STATE_UNLOCKED);
   pluginResponse.putInt(REMAIN_COUNT, remaining_count);
   pluginResponse.putInt(PLUGIN_ERROR_CODE, ERROR_NONE);
   // if state is STATE_BLOCKED,
   pluginResponse.putString(MISC_INFO, "Vendor specific message");
   return pluginResponse;
 }
 

This API will be called to initialize KeyguardPIN.
If user does not change default PIN yet, configure new default PIN.

 public Bundle initKeyguardPin(String newPin, Bundle options) {
   Bundle pluginResponse = new Bundle();
   pluginResponse.putInt(PLUGIN_ERROR_CODE, ERROR_NONE);
   return pluginResponse;
 }
 

• EVENT_PLUGIN_UNMANAGED
• EVENT_USER_REMOVED
• EVENT_PACKAGE_UNINSTALL
• EVENT_ADMIN_LICENSE_EXPIRED
• EVENT_ADMIN_LICENSE_RENEWED
• EVENT_FACTORY_RESET
• EVENT_DEVICE_LOCKED
• EVENT_DEVICE_UNLOCKED
• EVENT_BOOT_COMPLETED
• EVENT_KEYGUARD_SET
• EVENT_KEYGUARD_UNSET
• EVENT_CONTAINER_LOCKED
• EVENT_CONTAINER_UNLOCKED

UCM framework notify plugin when different event occured. Plugin application can peform operation based event received.

 public int notifyChange(int eventId, Bundle data) {
   int adminUid = data.getInt(ADMIN_UID, -1);
   int userId = data.getInt(USER_ID, -1);
   switch (eventId) {
     case EVENT_PLUGIN_UNMANAGED:
          Log.d(TAG, "plugin is unmanaged");
          break;
      case EVENT_USER_REMOVED:
          Log.d(TAG, "user is removed : " + userId);
          break;
      case EVENT_PACKAGE_UNINSTALL:
          int packageUid = data.getInt(PACKAGE_UID, NOT_INITIALIZED);
          Log.d(TAG, "application is uninstalled : " + packageUid);
          break;
      case EVENT_ADMIN_LICENSE_EXPIRED:
          Log.d(TAG, "Admin license is expired : " + adminUid);
          break;
      case EVENT_ADMIN_LICENSE_RENEWED:
          Log.d(TAG, "Admin license is renewed : " + adminUid);
          break;
      case EVENT_DEVICE_LOCKED:
          Log.d(TAG, "Device is locked : " + userId);
          break;
      case EVENT_DEVICE_UNLOCKED:
          Log.d(TAG, "Device is unlocked : " + userId);
          break;
      case EVENT_KEYGUARD_SET:
          Log.d(TAG, "UCM Keyguard is set : " + userId);
          break;
      case EVENT_KEYGUARD_UNSET:
          Log.d(TAG, "UCM Keyguard is unset : " + userId);
          break;
      default:
          Log.d(TAG, " Event ID: " + eventId);
      }
      return 0;
  }
 

Some Credential Storage has each plugin specific properties like PIN timeout. Configurator can manage plugin properties using this API.
This API is used to set plugin specific properties.

 public Bundle setCredentialStorageProperty(int adminUid, String userId, Bundle extra) {
   int pinCacheOption = extra.getInt(BUNDLE_EXTRA_PIN_CACHE, -1);
   return extra;
 }
 

This API will be called to set condition about length of PIN. When user changes PIN, user should follow this condition about minimumPinLength, maximumPinLength.

 public Bundle setKeyguardPinMaximumLength(int maximumPinLength) {
   Bundle pluginResponse = new Bundle();
   pluginResponse.putInt(PLUGIN_ERROR_CODE, ERROR_NONE);
   return pluginResponse;
 }