{"record":{"id":"9dc9d6169d78ef83","repo":"microg/GmsCore","slug":"client-not-admin-yet-tried-to-enable-work-authent","errorCode":null,"errorMessage":"client not admin, yet tried to enable work authenticator","messagePattern":"client not admin, yet tried to enable work authenticator","errorType":"exception","errorClass":"SecurityException","httpStatus":null,"severity":"error","filePath":"play-services-auth-workaccount/core/src/main/kotlin/org/microg/gms/auth/workaccount/WorkAccountService.kt","lineNumber":138,"sourceCode":"                    Intent(WORK_ACCOUNT_CHANGED_BOARDCAST).setPackage(\"com.android.vending\")\n                )\n\n                callback?.onAccountRemoved(success)\n            } else {\n                val future = accountManager.removeAccount(it, null, null)\n                Thread {\n                    future.result.let { result ->\n                        callback?.onAccountRemoved(result)\n                    }\n                }.start()\n            }\n        }\n    }\n}\n\nclass UnauthorizedWorkAccountServiceImpl : IWorkAccountService.Stub() {\n    override fun setWorkAuthenticatorEnabled(enabled: Boolean) {\n        throw SecurityException(\"client not admin, yet tried to enable work authenticator\")\n    }\n\n    override fun addWorkAccount(callback: IWorkAccountCallback?, token: String?) {\n        throw SecurityException(\"client not admin, yet tried to add work account\")\n    }\n\n    override fun removeWorkAccount(callback: IWorkAccountCallback?, account: Account?) {\n        throw SecurityException(\"client not admin, yet tried to remove work account\")\n    }\n}","sourceCodeStart":120,"sourceCodeEnd":148,"githubUrl":"https://github.com/microg/GmsCore/blob/157c9d86ac46c195a86c2f15ab55c84036223f95/play-services-auth-workaccount/core/src/main/kotlin/org/microg/gms/auth/workaccount/WorkAccountService.kt#L120-L148","documentation":"UnauthorizedWorkAccountServiceImpl.setWorkAuthenticatorEnabled unconditionally throws this SecurityException. This stub is returned to clients that are not authorized to manage work accounts (not an admin/delegated caller), so any attempt to toggle the work authenticator through it always fails by design — it is an intentional authorization guard, not a bug.","triggerScenarios":"Calling setWorkAuthenticatorEnabled(true/false) via IWorkAccountService when the bound implementation is UnauthorizedWorkAccountServiceImpl, i.e. the caller lacks the admin/authorization the service requires.","commonSituations":"A third-party app binding to the microG work-account service without being an authorized admin client; calling the work authenticator API from a non-device-owner context; attempting work-account management without the required system/admin privileges.","solutions":["Become an authorized caller: the client must satisfy the service's admin/authorization check (e.g. hold the required system/admin permission or be the designated authenticator admin)","Use the Android AccountManager work-authenticator APIs available to regular apps instead of the restricted service","Catch SecurityException and degrade gracefully (inform the user work-account management is unavailable)","Request device-owner/admin provisioning if work-account administration is genuinely required"],"exampleFix":"// before\nworkAccountService.setWorkAuthenticatorEnabled(true)\n// after\ntry {\n    workAccountService.setWorkAuthenticatorEnabled(true)\n} catch (e: SecurityException) {\n    Log.w(TAG, \"Not authorized to manage work authenticator\", e)\n}","handlingStrategy":"try-catch","validationCode":"val authorized = ctx.checkCallingOrSelfPermission(ADMIN_PERMISSION) == PackageManager.PERMISSION_GRANTED // per service policy","typeGuard":null,"tryCatchPattern":"try { svc.setWorkAuthenticatorEnabled(true) } catch (e: SecurityException) { showNotAuthorizedUi() }","preventionTips":["Only manage work accounts from an authorized/admin context","Prefer AccountManager public APIs for third-party work-account needs","Catch SecurityException around all IWorkAccountService calls"],"tags":["android","security","work-account","authorization"],"backgroundTag":"insufficient-permissions","analyzedSha":"157c9d86ac46c195a86c2f15ab55c84036223f95","analyzedAt":"2026-09-06T17:27:33.892Z","contentChangedAt":"2026-09-06T17:27:33.892Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}