Question

I am writing a GMail client for Android. I want to list all GMail accounts in a ListView. When the user clicks one item, I want the program to retrieve the password of the corresponding account.

However, I get a SecurityException:

java.lang.SecurityException: caller uid 10107 is different than the authenticator's uid

This is my code:

AccountManager accountManager = AccountManager.get(context);

this.username = account.name;
this.password = accountManager.getPassword(account); //this is where I get the exception

I have all these permissions in AndroidManifest.xml:

<uses-permission android:name="android.permission.AUTHENTICATE_ACCOUNTS"></uses-permission>
<uses-permission android:name="android.permission.GET_ACCOUNTS"></uses-permission>
<uses-permission android:name="android.permission.MANAGE_ACCOUNTS"></uses-permission>
<uses-permission android:name="android.permission.USE_CREDENTIALS"></uses-permission>
<uses-permission android:name="android.permission.INTERNET"></uses-permission>

According to Android reference, the only permission needed should be MANAGE_ACCOUNTS.

What is the problem of my code?

Answer 1

You can get an authtoken, but you can’t get the users actual credentials. The actually creditials are only accessible by the application that created them. From the documentation of the getPassword method (emphasis mine):

This method requires the caller to hold the permission AUTHENTICATE_ACCOUNTS and to have the same UID as the account’s authenticator.