Files

T

defiQUG a2dc194a49 Monorepo: Gitea CI, docs, auth/sync, backend APIs, gitignore

- Add Gitea Actions workflow; point README to gitea.d-bis.org/Sankofa_Phoenix/SMOA
- Expand .gitignore for Spring H2 data, secrets, Kotlin .kotlin/, tooling
- Track docs/api/generated ReDoc bundle; refresh api docs README
- Android: network/auth/sync, UI shell, tests; backend credentials/integrity APIs
- Docs, scripts (generate-api-docs), modules and core updates

Made-with: Cursor

2026-03-23 20:19:24 -07:00

2.3 KiB

Raw Permalink Blame History

Enterprise security configuration (SMOA Android)

Build-time Gradle properties (-P or gradle.properties) map to BuildConfig and runtime behavior.

TLS certificate pinning

Obtain SPKI SHA-256 pins for your API host (e.g. openssl s_client -connect host:443 | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64 → prefix with sha256/).
Set backend base URL so the host can be resolved: -Psmoa.backend.baseUrl=https://api.example.com/
Set pins: -Psmoa.tls.pins=sha256/PRIMARY==,sha256/BACKUP==

Pinning applies only when SMOA_BACKEND_BASE_URL yields a host. Config-only deployments should still set a canonical backend URL for pinning, or extend NetworkPinningConfig to read RemoteEndpointStore.

OIDC / OAuth

Set issuer, client id, and redirect URI matching your IdP and app manifest intent-filter:

smoa.oidc.issuer
smoa.oidc.clientId
smoa.oidc.redirectUri

Tokens are stored in SecureTokenStore (encrypted). AuthTokenInterceptor adds Authorization: Bearer when an access token exists. Wire AppAuth or your SSO WebView** to call SecureTokenStore.persistTokens(...) after code exchange.

Session lock

smoa.session.timeoutMinutes (default 15). Set to 0 to disable background lock. Unlock uses the same biometric flow as sign-in (SessionLockOverlay).

Play Integrity

Set smoa.playIntegrity.cloudProjectNumber to your Google Cloud project number linked in Play Console. Use User settings → Run Play Integrity for a smoke test; verify tokens on your backend with Google’s API.

Classification label

smoa.classification.buildMarking is shown in User settings and should match your security office’s build marking policy (not a substitute for data labeling in content).

Knox / MDM

KnoxEnterpriseProbe only detects Knox classes on the classpath. For enforcement, integrate Samsung Knox SDK or your UEM (VMware Workspace ONE, Intune, etc.) per deployment standards.

Biometric-gated AES key

BiometricSecretsVault creates a user-authentication-required AES key in AndroidKeyStore for wrapping secrets. Complete cipher + BiometricPrompt.CryptoObject wiring when binding refresh-token protection to your IdP flow.

2.3 KiB Raw Permalink Blame History Unescape Escape