Access Control

• Introduction
• Directory Structure
• Usage
• Available APIs
• Usage Guidelines
• Native Process
• App HAP
• Repositories Involved

Introduction

AccessTokenManager (ATM) provides unified app permission management based on access tokens on OpenHarmony.

The access token information of an app includes the app identifier (APPID), user ID, app twin index, app Ability Privilege Level (APL), and permission information. The access token of each app is identified by a 32-bit token identity (TokenID) in the device.

The ATM module provides the following functions:

• Verifying app permissions based on the token ID before an app accesses sensitive data or calls an API.
• Obtaining access token information (for example, APL) based on the token ID.

Directory Structure

/base/security/access_token
├── frameworks                  # Stores code of basic functionalities.
│   ├── accesstoken             # Stores code of the ATM framework.
│   ├── tokensync               # Stores code of the access token synchronization framework.
│   └── common                  # Stores framework common code.
├── interfaces                  # Stores the APIs.
│   ├── innerkits               # Stores internal APIs.
│       ├── accesstoken         # Stores code of access token internal APIs.
│       ├── nativetoken         # Stores code of native token APIs.
│       └── tokensync           # Stores code of the internal APIs for access token synchronization.
└── services                    # Services
    ├── accesstokenmanager      # Stores ATM service code.
    └── tokensyncmanager        # Stores code of the access token synchronization service. 

Usage

Available APIs

Usage Guidelines

ATM provides unified access control for apps and allows apps or service abilities to obtain and verify app permissions and APL. The ATM APIs can be called by a service ability started by a native process or an app HAP.

Native Process

• Before a native process starts, it calls GetAccessTokenId to obtain a token ID, and then calls SetSelfTokenID to set the token ID to the kernel.
• During the running of a native process, it calls GetNativeTokenInfo or CheckNativeDCap to obtain the token information, including the distributed capability and APL.

App HAP

• When an app is installed, AllocHapToken is called to obtain the token ID of the app.
• When an authentication is required during app running, VerifyAccessToken or GetReqPermissions is called to obtain and verify the app permissions and APL.
• When an app is uninstalled, DeleteToken is called to delete the related access token information.

Repositories Involved

startup_init_lite

security_device_auth

security_access_token