Application integrity
In the IDAAS-core configuration, you can select one of the two app integrity levels: NONE or FULL. The FULL level performs several checks for the app, including a tampering/modification check, by validating the signing key of the app. The hash of the key that was used to sign the app is calculated by the Android SDK at runtime during the DCR and it is verified against the hash stored in the IDAAS-core. To obtain the hash for the IDAAS-core configuration, use the guide below.
When the app integrity level is set to NONE, the Android SDK performs only the most basic sanity checks (like the app's name), but does not validate the signing keys.
Obtain the hash of the signing key
When you create an Android app, you need to sign it using one of the following:
-
A debug key provided by Android Studio
-
A signing key created by yourself: If the key is stored on your machine, you can use keytool to obtain information about the signing key, as described in Authenticating your client.
-
Sign the app with upload key and let Google Play App Signing apply the final signing. If you use Google Play App Signing, then your signing key is stored in the Google Play Store. You can find it in the Release > Setup > App Integrity tab.
The Android SDK uses the SHA-256 fingerprint of the signing key.
Example keytool output with visible SHA-256 fingerprint
Store the app signatures
The SHA-256 value that is obtained must be stored in the admin console. Every application version has its list of valid signatures. The application version documentation provides more info on where and how to store the application signature for a specific application version.
