OpenHarmony上设置人脸认证

　　本文主要简析OpenHarmony的用户鉴权管理。
　　用户凭证管理
　　pinauth（口令认证）：模块支持用户口令的设置，删除和认证功能。
　　与用户IAM子系统基础框架配合，也可以支持用户口令修改的功能；口令认证作为OpenHarmony最基础的用户身份认证执行器，按照协同认证定义的资源注册接口，将口令认证相关资源信息注册到协同认证框架，并根据协同认证框架的调度，完成口令的设置，删除和认证功能。
　　faceauth（人脸认证）：支持用户人脸的录入，删除和认证功能；人脸认证是OpenHarmony支持的一种生物认证执行器，按照协同认证定义的资源注册接口，将人脸认证相关资源信息注册到协同认证框架，并根据协同认证框架的调度，调用人脸认证HDI，完成人脸的录入，认证，删除等功能。
　　userauthframework：主要包括三个模块，用户认证、凭据管理和执行器管理。
　　用户认证模块对外提供统一用户身份认证功能，并且开放生物特征认证API给三方应用调用。
　　凭据管理模块提供系统内统一的用户凭据管理（增删改查）接口，向下通过执行器管理模块，调用系统内的执行器资源，完成用户凭据的生命周期管理和安全存储。
　　执行器管理模块提供系统内执行器资源的统一管理和协同调度能力，当前支持口令执行器和人脸执行器的管理。
　　使用
　　接口：importosAccountfromohos。account。osAccount
　　凭证管理：UserIdentityManagerProvidestheabilitiesformanaginguseridentity。nameUserIdentityManagersyscapSystemCapability。Account。OsAccountsince8classUserIdentityManager｛ConstructortogettheUserIdentityManagerclassinstance。returnsReturnstheUserIdentityManagerclassinstance。systemapiHidethisforinnersystemuse。since8constructor（）；Openssession。pStartanIDMoperationtoobtainchallengevalue。Achallengevalueof0indicatesthatopensessionfailed。permissionohos。permission。MANAGEUSERIDMreturnsReturnsachallengevalue。throws｛BusinessError｝201permissiondenied。throws｛BusinessError｝401theparametercheckfailed。throws｛BusinessError｝12300001systemserviceexception。systemapiHidethisforinnersystemuse。since8openSession（callback：AsyncCallbackUint8Array）：void；openSession（）：PromiseUint8Array；Addscredential。pAddusercredentialinformation，passincredentialadditionmethodandcredentialinformation（credentialtype，subclass，ifaddingusersnonpasswordcredentials，passinpasswordauthenticationtoken），andgettheresultacquireinfocallback。permissionohos。permission。MANAGEUSERIDMparamcredentialInfoIndicatesthecredentialinformation。paramcallbackIndicatesthecallbacktogetresultsandacquireInfo。throws｛BusinessError｝201permissiondenied。throws｛BusinessError｝401theparametercheckfailed。throws｛BusinessError｝12300001systemserviceexception。throws｛BusinessError｝12300002invalidcredentialInfo。systemapiHidethisforinnersystemuse。since8addCredential（credentialInfo：CredentialInfo，callback：IIdmCallback）：void；Updatescredential。permissionohos。permission。MANAGEUSERIDMparamcredentialInfoIndicatesthecredentialinformation。paramcallbackIndicatesthecallbacktogetresultsandacquireInfo。throws｛BusinessError｝201permissiondenied。throws｛BusinessError｝401theparametercheckfailed。throws｛BusinessError｝12300001systemserviceexception。throws｛BusinessError｝12300002invalidcredentialInfo。systemapiHidethisforinnersystemuse。since8updateCredential（credentialInfo：CredentialInfo，callback：IIdmCallback）：void；Closessession。pEndanIDMoperation。permissionohos。permission。MANAGEUSERIDMsystemapiHidethisforinnersystemuse。since8closeSession（）：void；Cancelsentrywithachallengevalue。permissionohos。permission。MANAGEUSERIDMparamchallengeIndicatesthechallengevalue。throws｛BusinessError｝201permissiondenied。throws｛BusinessError｝401theparametercheckfailed。throws｛BusinessError｝12300001systemserviceexception。throws｛BusinessError｝12300002invalidchallenge。systemapiHidethisforinnersystemuse。since8cancel（challenge：Uint8Array）：void；Deletestheuserwiththeauthenticationtoken。permissionohos。permission。MANAGEUSERIDMparamtokenIndicatestheauthenticationtoken。paramcallbackIndicatesthecallbacktogetthedeletionresult。throws｛BusinessError｝201permissiondenied。throws｛BusinessError｝401theparametercheckfailed。throws｛BusinessError｝12300001systemserviceexception。throws｛BusinessError｝12300002invalidtoken。systemapiHidethisforinnersystemuse。since8delUser（token：Uint8Array，callback：IIdmCallback）：void；Deletestheusercredentialinformation。permissionohos。permission。MANAGEUSERIDMparamcredentialIdIndicatesthecredentialindex。paramtokenIndicatestheauthenticationtoken。paramcallbackIndicatesthecallbacktogetthedeletionresult。throws｛BusinessError｝201permissiondenied。throws｛BusinessError｝401theparametercheckfailed。throws｛BusinessError｝12300001systemserviceexception。throws｛BusinessError｝12300002invalidcredentialIdortoken。systemapiHidethisforinnersystemuse。since8delCred（credentialId：Uint8Array，token：Uint8Array，callback：IIdmCallback）：void；Getsauthenticationinformation。permissionohos。permission。USEUSERIDMparamauthTypeIndicatestheauthenticationtype。paramcallbackIndicatesthecallbacktogetallregisteredcredentialinformationofthespecifiedtypeforthecurrentuser。throws｛BusinessError｝201permissiondenied。throws｛BusinessError｝401theparametercheckfailed。throws｛BusinessError｝12300001systemserviceexception。throws｛BusinessError｝12300002invalidauthType。throws｛BusinessError｝12300015theauthTypeisnotsupportedoncurrentdevice。throws｛BusinessError｝12300016authenticationtimeout。throws｛BusinessError｝12300017authenticationserviceisbusy。throws｛BusinessError｝12300018authenticationserviceislocked。throws｛BusinessError｝12300019thecredentialdoesnotexist。systemapiHidethisforinnersystemuse。since8getAuthInfo（callback：AsyncCallback）：void；getAuthInfo（authType：AuthType，callback：AsyncCallback）：void；getAuthInfo（authType？：AuthType）：Promise；｝
　　口令管理：ProvidestheabilitiesforPincodeauthentication。namePINAuthsyscapSystemCapability。Account。OsAccountsince8classPINAuth｛ConstructortogetthePINAuthclassinstance。returnsReturnsthePINAuthclassinstance。systemapiHidethisforinnersystemuse。since8constructor（）；Registerinputer。permissionohos。permission。ACCESSPINAUTHparaminputerIndicatesthepasswordinputboxcallbackthrows｛BusinessError｝201permissiondenied。throws｛BusinessError｝401theparametercheckfailed。throws｛BusinessError｝12300001systemserviceexception。throws｛BusinessError｝12300007PINinputerhasbeenregistered。systemapiHidethisforinnersystemuse。since8registerInputer（inputer：IInputer）：void；Unregisterinputer。permissionohos。permission。ACCESSPINAUTHsystemapiHidethisforinnersystemuse。since8unregisterInputer（）：void；
　　回调：IInputData，Inputer回调时带的参数，用来输入口令。Passworddatacallback。nameIInputDatasyscapSystemCapability。Account。OsAccountsystemapiHidethisforinnersystemuse。since8interfaceIInputData｛Notifiestosetdata。parampinSubTypeIndicatesthecredentialsubtypeforauthentication。paramdataIndicatesthedatatoset。throws｛BusinessError｝401theparametercheckfailed。throws｛BusinessError｝12300002invalidpinSubType。systemapiHidethisforinnersystemuse。since8onSetData：（pinSubType：AuthSubType，data：Uint8Array）void；｝
　　回调：IInputer，regitsterInputer是传入的回调，在需要输口令时被调用。Passwordinputboxcallback。nameIInputersyscapSystemCapability。Account。OsAccountsystemapiHidethisforinnersystemuse。since8interfaceIInputer｛Notifiestogetdata。parampinSubTypeIndicatesthecredentialsubtypeforauthentication。paramcallbackIndicatesthepassworddatacallback。systemapiHidethisforinnersystemuse。since8onGetData：（pinSubType：AuthSubType，callback：IInputData）void；｝
　　回调：IUserAuthCallback，auth，authUser的回调，用来接收auth的结果。Userauthenticationcallback。nameIUserAuthCallbacksyscapSystemCapability。Account。OsAccountsystemapiHidethisforinnersystemuse。since8interfaceIUserAuthCallback｛Theauthenticationresultcodeisreturnedthroughthecallback。paramresultIndicatestheauthenticationresultcode。paramextraInfoIndicatesthespecificinformationfordifferentsituation。Iftheauthenticationispassed，theauthenticationtokenisreturnedinextrainfo，Iftheauthenticationfails，theremainingauthenticationtimesarereturnedinextrainfo，Iftheauthenticationexecutorislocked，thefreezingtimeisreturnedinextrainfo。systemapiHidethisforinnersystemuse。since8onResult：（result：number，extraInfo：AuthResult）void；Duringanauthentication，theTipsCodeisreturnedthroughthecallback。parammoduleIndicatestheexecutortypeforauthentication。paramacquireIndicatesthetipcodefordifferentauthenticationexecutor。paramextraInforeservedparameter。systemapiHidethisforinnersystemuse。since8onAcquireInfo？：（module：number，acquire：number，extraInfo：any）void；｝
　　回调：IIdmCallback，addCredential，updateCredential，delUser，delCred的回调，用来收听onResult是否成功。Identitymanagercallback。nameIIdmCallbacksyscapSystemCapability。Account。OsAccountsystemapiHidethisforinnersystemuse。since8interfaceIIdmCallback｛Theauthenticationresultcodeisreturnedthroughthecallback。paramresultIndicatestheauthenticationresultcode。paramextraInfopassthespecificinformationfordifferentsituation。systemapiHidethisforinnersystemuse。since8onResult：（result：number，extraInfo：RequestResult）void；Duringanauthentication，theTipsCodeisreturnedthroughthecallback。parammoduleIndicatestheexecutortypeforauthentication。paramacquireIndicatesthetipcodefordifferentauthenticationexecutor。paramextraInforeservedparameter。systemapiHidethisforinnersystemuse。since8onAcquireInfo？：（module：number，acquire：number，extraInfo：any）void；｝
　　流程
　　如下图：
　　构建对象三个对象this。userIdentityManagernewosAccount。UserIdentityManager（）；this。pinAuthnewosAccount。PINAuth（）；this。userAuthnewosAccount。UserAuth（）；
　　opensessionOpenSessionAchallengevalueof0indicatesthatopensessionfailedreturnschallengevalueopenSession（callback：（challenge：string）void）：void｛LogUtil。debug（｛this。TAG｝openSessionin。）；try｛this。userIdentityManager。openSession（）。then（（data）｛callback（this。u8AToStr（data））；LogUtil。info（｛this。TAG｝openSessionsuccess）；｝）。catch（（err）｛LogUtil。error（｛this。TAG｝openSessionfailedJSON。stringify（err））；｝）｝catch｛LogUtil。error（｛this。TAG｝openSessionfailed）；callback（0）；｝LogUtil。debug（｛this。TAG｝openSessionout。）；｝
　　注册inputerRegisterInputerregisterInputer（）：boolean｛LogUtil。debug（｛this。TAG｝registerInputerin。）；letresultfalse；try｛resultthis。pinAuth。registerInputer（｛onGetData：（authSubType，inputData）｛letu8aPwdthis。encodeToU8A（this。password）；LogUtil。info（｛this。TAG｝beforesetdata，type：｛this。pinSubType｝。）；inputData。onSetData（this。pinSubType，u8aPwd）；｝｝）；if（！result）｛this。unregisterInputer（）；resultthis。pinAuth。registerInputer（｛onGetData：（authSubType，inputData）｛letu8aPwdthis。encodeToU8A（this。password）；inputData。onSetData（this。pinSubType，u8aPwd）；｝｝）；｝｝catch｛LogUtil。error（｛this。TAG｝registerInputerfailed）；｝LogUtil。info（｛this。TAG｝registerInputerout。）；returnresult；｝
　　createPasswordGetAuthInfoparamauthTypeCredentialtype。returnsReturnsallregisteredcredentialinformationofthistypeforthecurrentusergetPinAuthInfo（callback：（data：Array｛authType：number；authSubType：number；｝）void）：void｛LogUtil。debug（｛this。TAG｝getPinAuthInfoin。）；try｛this。userIdentityManager。getAuthInfo（AuthType。PIN）。then（（data）｛LogUtil。info（｛this。TAG｝getpinauthinfodata。）；letarrCredInfo〔〕；try｛for（leti0；idata。length；i）｛letcredInfo｛authType：data〔i〕。authType，authSubType：data〔i〕。authSubType｝；if（credInfo。authTypeAuthType。PIN）｛this。pinSubTypecredInfo。authSubType；｝arrCredInfo。push（credInfo）；｝｝catch（e）｛LogUtil。info（faceDemopin。getAuthInfoerrore）；｝callback（arrCredInfo）；LogUtil。info（｛this。TAG｝getAuthInfosuccess。）；｝）。catch（（err）｛LogUtil。error（｛this。TAG｝getAuthInfofailed。JSON。stringify（err））；｝）｝catch（e）｛LogUtil。error（｛this。TAG｝getPinAuthInfofailed：e）；｝LogUtil。debug（｛this。TAG｝getPinAuthInfoout。）；｝
　　getAuthInfoGetAuthInfoparamauthTypeCredentialtype。returnsReturnsallregisteredcredentialinformationofthistypeforthecurrentusergetPinAuthInfo（callback：（data：Array｛authType：number；authSubType：number；｝）void）：void｛LogUtil。debug（｛this。TAG｝getPinAuthInfoin。）；try｛this。userIdentityManager。getAuthInfo（AuthType。PIN）。then（（data）｛LogUtil。info（｛this。TAG｝getpinauthinfodata。）；letarrCredInfo〔〕；try｛for（leti0；idata。length；i）｛letcredInfo｛authType：data〔i〕。authType，authSubType：data〔i〕。authSubType｝；if（credInfo。authTypeAuthType。PIN）｛this。pinSubTypecredInfo。authSubType；｝arrCredInfo。push（credInfo）；｝｝catch（e）｛LogUtil。info（faceDemopin。getAuthInfoerrore）；｝callback（arrCredInfo）；LogUtil。info（｛this。TAG｝getAuthInfosuccess。）；｝）。catch（（err）｛LogUtil。error（｛this。TAG｝getAuthInfofailed。JSON。stringify（err））；｝）｝catch（e）｛LogUtil。error（｛this。TAG｝getPinAuthInfofailed：e）；｝LogUtil。debug（｛this。TAG｝getPinAuthInfoout。）；｝
　　autPinAuthparamchallengepassinchallengevalue。challenge是从openSession的回调得到parampasswordpasswordparamonResultReturnresultsthroughcallback。authPin（challenge：string，password：string，onResult：（result：number，extraInfo：｛token？：string；remainTimes？：number；freezingTime？：number；｝）void）：void｛LogUtil。debug（｛this。TAG｝authPinin。）；this。passwordpassword；try｛LogUtil。info（｛this。TAG｝beforeuserAuthauthpin）；this。userAuth。auth（this。strToU8A（challenge），AuthType。PIN，AuthTrustLevel。ATL4，｛onResult：（result，extraInfo）｛try｛if（resultResultCode。SUCCESS）｛LogUtil。debug（｛this。TAG｝userAuth。authonResult：resultsuccess）；｝else｛LogUtil。debug（｛this。TAG｝userAuth。authfailedonResult：result｛result｝）；｝letinfo｛token：this。u8AToStr（extraInfo？。token），remainTimes：extraInfo。remainTimes，freezingTime：extraInfo。freezingTime｝onResult（result，info）｝catch（e）｛LogUtil。debug（｛this。TAG｝userAuth。authonResulterror｛JSON。stringify（e）｝）；｝｝，onAcquireInfo：（acquireModule，acquire，extraInfo）｛try｛LogUtil。debug（this。TAGfaceDemopin。authonAcquireInfoacquireModuleacquireModule）；LogUtil。debug（this。TAGfaceDemopin。authonAcquireInfoacquireacquire）；｝catch（e）｛LogUtil。error（this。TAGfaceDemopin。authonAcquireInfoerrore）；｝｝｝）｝catch（e）｛LogUtil。error（｛this。TAG｝AuthPinfailed：e）；｝LogUtil。debug（｛this。TAG｝authPinout。）；｝
　　概述
　　主干代码：1014日下载的。
　　hilogbD：打开debug输出
　　可能需要的权限：ohos。permission。MANAGEUSERIDMohos。permission。USEUSERIDMohos。permission。MANAGELOCALACCOUNTSohos。permission。ACCESSUSERAUTHINTERNALohos。permission。ACCESSPINAUTH
　　运行settings，日志分析opensession112914：56：32。47328132813com。ohos。mysettingsIA00500〔Settings〕：SettingsPasswordModelopenSessionin。112914：56：32。47428132813com。ohos。mysettingsIA00500〔Settings〕：SettingsPasswordModelopenSessionout。registerInputer（不是系统hap，没有selinux权限，没打包设置）com。ohos。mysettingsIA00500〔Settings〕：SettingsPasswordModelregisterInputerin。com。ohos。mysettingsIC02441PINAUTHSDK：〔RegisterInputerpinauthregister。cpp：40〕startcom。ohos。mysettingsIC02441PINAUTHSDK：〔GetProxypinauthregister。cpp：70〕startaccesstokenserIC02f01AccessTokenManagerStub：〔OnRemoteRequest〕：OnRemoteRequestcalled，code：65296accesstokenserIC02f01PermissionManager：〔VerifyAccessToken〕：VerifyAccessTokencalled，tokenID：537131032，permissionName：ohos。permission。MANAGEUSERIDMaccesstokenserIC02f01AccessTokenManagerService：〔VerifyAccessToken〕：tokenID：537131032，permissionName：ohos。permission。MANAGEUSERIDM，res0samgrIC01800SAMGR：SystemAbilityManagerStub：：OnReceived，code2，callerPid2813，flags0accountmgrIC02f01AccessTokenManagerProxy：〔VerifyAccessToken〕：resultfromserverdata0samgrIC01800SAMGR：SystemAbilityManagerStub：：OnReceived，code2，callerPid571，flags0samgrEC02f02Selinux：avc：denied｛get｝forservice941pid2813scontextu：r：systemcorehap：s0tcontextu：objectr：sauseriampinauthservice：s0tclasssamgrclasspermissive0samgrEC01800SAMGR：CheckSystemAbilityInnerselinuxpermissiondenied！SA：941samgrIC01800SAMGR：foundservice：901。com。ohos。mysettingsEC01510BinderInvoker：125：SendRequest：handle0result1com。ohos。mysettingsEC02441PINAUTHSDK：〔GetProxypinauthregister。cpp：81〕getdistributedgallerymanagerservicefailcom。ohos。mysettingsEC02441PINAUTHSDK：〔RegisterInputerpinauthregister。cpp：47〕getproxyfailedcom。ohos。mysettingsEC01b00AccountIAM：〔RegisterInputer：89〕：Failedtoregisterinputercom。ohos。mysettingsEA00500〔Settings〕：SettingsPasswordModelregisterInputerfailedcom。ohos。mysettingsIA00500〔Settings〕：SettingsPasswordModelregisterInputerout。registerInputer（是系统hap，有分布式权限）com。ohos。settingsIC02441PINAUTHSDK：〔RegisterInputerpinauthregister。cpp：40〕startaccesstokenserIC02f01PermissionManager：〔VerifyAccessToken〕：VerifyAccessTokencalled，tokenID：537311758，permissionName：ohos。permission。MANAGEUSERIDMcom。ohos。settingsIC02441PINAUTHSDK：〔GetProxypinauthregister。cpp：70〕startaccesstokenserIC02f01AccessTokenManagerService：〔VerifyAccessToken〕：tokenID：537311758，permissionName：ohos。permission。MANAGEUSERIDM，res0samgrIC01800SAMGR：SystemAbilityManagerStub：：OnReceived，code2，callerPid3279，flags0accountmgrIC02f01AccessTokenManagerProxy：〔VerifyAccessToken〕：resultfromserverdata0samgrIC01800SAMGR：SystemAbilityManagerStub：：OnReceived，code2，callerPid571，flags0samgrIC01800SAMGR：foundservice：941。samgrIC01800SAMGR：foundservice：901。com。ohos。settingsIC02441PINAUTHSDK：〔GetProxypinauthregister。cpp：92〕succeedtoconnectdistributedgallerymanagerservicecom。ohos。settingsIC02441PINAUTHSDK：〔RegisterInputerpinauthproxy。cpp：30〕startcom。ohos。settingsIC02441PINAUTHSDK：〔SendRequestpinauthproxy。cpp：76〕code1accountmgrIC02401USERIDMSDK：〔SendRequestuseridmproxy。cpp：351〕code0pinauthIC02441PINAUTHSA：〔OnRemoteRequestpinauthstub。cpp：28〕cmd1，flags0pinauthIC02441PINAUTHSA：〔RegisterInputerStubpinauthstub。cpp：47〕startuseriamIC02421USERAUTHSA：〔OnRemoteRequestuseridmstub。cpp：32〕cmd0，flags0useriamIC02421USERAUTHSA：〔OpenSessionStubuseridmstub。cpp：66〕enteruseriamIC02421USERAUTHSA：〔OpenSessionuseridmservice。cpp：61〕startpinauthIC02441PINAUTHSA：〔RegisterInputerpinauthservice。cpp：112〕startpinauthIC02441PINAUTHSA：〔CheckPermissionpinauthservice。cpp：104〕startaccesstokenserIC02f01AccessTokenManagerStub：〔OnRemoteRequest〕：OnRemoteRequestcalled，code：65296accesstokenserIC02f01PermissionManager：〔VerifyAccessToken〕：VerifyAccessTokencalled，tokenID：537311758，permissionName：ohos。permission。MANAGEUSERIDMaccesstokenserIC02f01AccessTokenManagerService：〔VerifyAccessToken〕：tokenID：537311758，permissionName：ohos。permission。MANAGEUSERIDM，res0useriamIC02f01AccessTokenManagerProxy：〔VerifyAccessToken〕：resultfromserverdata0accesstokenserIC02f01AccessTokenManagerStub：〔OnRemoteRequest〕：OnRemoteRequestcalled，code：65296samgrIC01800SAMGR：SystemAbilityManagerStub：：OnReceived，code12，callerPid924，flags0accesstokenserIC02f01PermissionManager：〔VerifyAccessToken〕：VerifyAccessTokencalled，tokenID：671961229，permissionName：ohos。permission。MANAGEUSERIDMaccesstokenserIC02f01AccessTokenManagerService：〔VerifyAccessToken〕：tokenID：671961229，permissionName：ohos。permission。MANAGEUSERIDM，res0useriamIC02f01AccessTokenManagerProxy：〔VerifyAccessToken〕：resultfromserverdata0samgrIC01800SAMGR：foundservice：3503。accesstokenserIC02f01AccessTokenManagerStub：〔OnRemoteRequest〕：OnRemoteRequestcalled，code：65316accesstokenserIC02f01AccessTokenManagerService：〔GetTokenType〕：called，tokenID：0x280ff12caccesstokenserIC02f01AccessTokenManagerService：〔GetNativeTokenInfo〕：called，tokenID：0x280d508duseriamIC02f01AccessTokenManagerProxy：〔GetNativeTokenInfo〕：resultfromserverdata0samgrIC01800SAMGR：SystemAbilityManagerStub：：OnReceived，code12，callerPid483，flags0pinauthIC02f01AccessTokenManagerProxy：〔VerifyAccessToken〕：resultfromserverdata0pinauthIC02441PINAUTHSA：〔RegisterInputerpinauthmanager。cpp：29〕start，tokenId537311758pinauthIC02441PINAUTHSA：〔RegisterInputerpinauthmanager。cpp：47〕endcom。ohos。settingsIA00500〔Settings〕：SettingsPasswordModelregisterInputerout。getAuthInfo（找不到）com。ohos。mysettingsIA00500〔Settings〕：SettingsPasswordModelgetpinauthinfodata。com。ohos。mysettingsIA00500〔Settings〕：SettingsPasswordSettingControllergetListData（false，）incom。ohos。mysettingsIA00500〔Settings〕：SettingsPasswordSettingControllergetListData（false，）outundefinedcom。ohos。mysettingsIA00500〔Settings〕：SettingsPasswordModelgetAuthInfosuccess。getAuthInfo（找到）com。ohos。settingsIA00500〔Settings〕：SettingsPasswordModelgetpinauthinfodata。com。ohos。settingsIA00500〔Settings〕：SettingshgetListData（true，）incom。ohos。settingsIA00500〔Settings〕：SettingshgetListData（true，）outundefinedcom。ohos。settingsIA00500〔Settings〕：SettingsPasswordModelgetAuthInfosuccess。addCredential（添加口令失败，因为不是系统hap所以没有成功注册inputer）com。ohos。mysettingsIA00500〔Settings〕：SettingsPasswordInputControllerpasswordOnChangein。com。ohos。mysettingsIA00500〔Settings〕：SettingsPasswordInputControllercheckInputDigitsin。com。ohos。mysettingsIA00500〔Settings〕：SettingsPasswordCheckerisNumber6in。com。ohos。mysettingsIA00500〔Settings〕：SettingsPasswordModeladdPinCredentialin。com。ohos。mysettingsIA00500〔Settings〕：SettingsPasswordModeladdPinCredentialout。com。ohos。mysettingsIA00500〔Settings〕：SettingsPasswordInputControllerpasswordOnChangeout。useriamIC02f01AccessTokenManagerProxy：〔GetNativeTokenInfo〕：resultfromserverdata0useriamIC02421USERAUTHSA：〔Startbasecontext。cpp：56〕Context（type：Enroll，contextId：0xXXXX7702）startuseriamIC02421USERAUTHSA：〔OnStartenrollcontext。cpp：43〕Context（type：Enroll，contextId：0xXXXX7702）startsamgrIC01800SAMGR：SystemAbilityManagerStub：：OnReceived，code12，callerPid483，flags0samgrIC01800SAMGR：foundservice：5100。hdfdevmgrIC02500devsvcmanagerstub：serviceuserauthinterfaceservicefounduserauthhost17userauthhostIC02421USERAUTHHDI：〔BeginEnrollmentuserauthinterfaceservice。cpp：374〕startuserauthhost17userauthhostIC02421USERAUTHHDI：〔CopyScheduleInfouserauthinterfaceservice。cpp：69〕startuseriamIC02421USERAUTHSA：〔Buildschedulenodebuilder。cpp：114〕scheduleNodebuilderstarttobuilduseriamIC02421USERAUTHSA：〔Schedulefinitestatemachineimpl。cpp：51〕fsmschedulenewscheduleeventinput：0useriamIC02421USERAUTHSA：〔OnStartenrollcontext。cpp：51〕Context（type：Enroll，contextId：0xXXXX7702）successuseriamIC02421USERAUTHSA：〔operator（）useridmstub。cpp：158〕leaveuseriamIC02421USERAUTHSA：〔BeginExecuteresourcenodeimpl。cpp：138〕startuseriamIC02421USERAUTHSA：〔SendRequestexecutorcallbackproxy。cpp：195〕code2pinauthIC02421USERAUTHEXECUTOR：〔OnBeginExecuteInnerframeworkexecutorcallback。cpp：64〕ExecutorCallback（Id：1）startprocesscmd0pinauthIC02421USERAUTHEXECUTOR：〔StartProcessasynccommandbase。cpp：56〕Command（type：ENROLL，id：3，scheduleId：0xXXXX246e）startprocesspinauthIC02421USERAUTHEXECUTOR：〔AddCommandexecutor。cpp：105〕Executor（Id：0x00010001）startpinauthIC02421USERAUTHEXECUTOR：〔SendRequestenrollcommand。cpp：42〕Command（type：ENROLL，id：3，scheduleId：0xXXXX246e）sendrequeststartpinauthhost16pinauthhostIC02441PINAUTHIMPL：〔Enrollexecutorimpl。cpp：123〕startpinauthhost16pinauthhostIC02441PINAUTHIMPL：〔NewSaltexecutorimpl。cpp：290〕startpinauthhost16pinauthhostIC02441PINAUTHIMPL：〔NewSaltexecutorimpl。cpp：315〕EVPsha256successpinauthhost16pinauthhostIC02441PINAUTHIMPL：〔NewSaltexecutorimpl。cpp：326〕resultsizeis：〔32〕pinauthhost16pinauthhostIC02441PINAUTHIMPL：〔AddScheduleInfoexecutorimpl。cpp：333〕startpinauthIC02441PINAUTHSA：〔OnGetDatapinauthexecutorcallbackhdi。cpp：48〕StarttokenIdis537131032pinauthIC02441PINAUTHSA：〔getInputerLockpinauthmanager。cpp：65〕startpinauthEC02441PINAUTHSA：〔getInputerLockpinauthmanager。cpp：71〕pinAuthInputerisnotfoundpinauthEC02441PINAUTHSA：〔OnGetDatapinauthexecutorcallbackhdi。cpp：51〕inputerisnullptrpinauthEC02500executorcallbackstub：ExecutorCallbackStubOnGetDatafailed，errorcodeisprivatepinauthhost16pinauthhostEC01510BinderInvoker：125：SendRequest：handle3result1pinauthhost16pinauthhostEC02500executorcallbackproxy：OnGetDatafailed，errorcodeis1pinauthhost16pinauthhostEC02441PINAUTHIMPL：〔Enrollexecutorimpl。cpp：143〕EnrollPinfailed，failcode：1pinauthhost16pinauthhostIC02441PINAUTHIMPL：〔DeleteScheduleIdexecutorimpl。cpp：369〕startpinauthhost16pinauthhostIC02441PINAUTHIMPL：〔DeleteScheduleIdexecutorimpl。cpp：372〕DeletescheduleIdsuccpinauthhost16pinauthhostEC02500executorstub：ExecutorStubEnrollfailed，errorcodeisprivatecom。ohos。mysettingsIC01c00ImsaKit：line：483，function：OnConfigurationChange，InputMethodController：：OnConfigurationChangecom。ohos。mysettingsWC03900Ace：〔rendertextfield。cpp（UpdateAccessibilityAttr）（0）〕RenderTextFieldaccessibilityNodeisnull。pinauthEC01510BinderInvoker：125：SendRequest：handle2result1pinauthEC02500executorproxy：Enrollfailed，errorcodeis1pinauthEC02441PINAUTHSA：〔ConvertResultCodepinauthexecutorhdi。cpp：317〕coverthdiresultcode1toframeworkresultcode1pinauthEC02441PINAUTHSA：〔Enrollpinauthexecutorhdi。cpp：131〕Enrollfailret1pinauthIC02421USERAUTHEXECUTOR：〔SendRequestenrollcommand。cpp：53〕Command（type：ENROLL，id：3，scheduleId：0xXXXX246e）enrollresult1pinauthEC02421USERAUTHEXECUTOR：〔StartProcessasynccommandbase。cpp：65〕Command（type：ENROLL，id：3，scheduleId：0xXXXX246e）sendrequestfailedpinauthIC02421USERAUTHEXECUTOR：〔EndProcessasynccommandbase。cpp：112〕Command（type：ENROLL，id：3，scheduleId：0xXXXX246e）endprocesspinauthIC02421USERAUTHEXECUTOR：〔RemoveCommandexecutor。cpp：113〕Executor（Id：0x00010001）startpinauthIC02421USERAUTHEXECUTOR：〔OnBeginExecuteInnerframeworkexecutorcallback。cpp：80〕commandid0ret1useriamEC02421USERAUTHSA：〔ProcessBeginVerifierschedulenodeimpl。cpp：281〕startverifyfaileduseriamIC02421USERAUTHSA：〔ScheduleInnerfinitestatemachineimpl。cpp：84〕fsmscheduleschedule〔state：0〕〔event：0〕〔nextState：1〕useriamIC02421USERAUTHSA：〔OnResultenrollcontext。cpp：57〕Context（type：Enroll，contextId：0xXXXX7702）receiveresultcode7useriamEC02421USERAUTHSA：〔UpdateScheduleResultenrollcontext。cpp：88〕（scheduleResultAttr！nullptr）checkfail，returnuseriamEC02421USERAUTHSA：〔OnResultenrollcontext。cpp：62〕Context（type：Enroll，contextId：0xXXXX7702）UpdateScheduleResultfailuseriamIC02421USERAUTHSA：〔OnResultuseridmcallbackproxy。cpp：29〕startuseriamIC02421USERAUTHSA：〔SendRequestuseridmcallbackproxy。cpp：87〕startaccountmgrEC01b00AccountMgrService：〔OnResult：138〕：failedtoaddcredentialcom。ohos。mysettingsIC03900NAPI：〔nativeapi。cpp（napicallfunction）〕engine：00F1D680，nativeRecv：CD18BAE0，nativeFunc：CD18BC18，nativeArgv：FF95C088com。ohos。mysettingsIA00500〔Settings〕：SettingsPasswordModelAddpincredential，result：7com。ohos。mysettingsIA00500〔Settings〕：SettingsPasswordInputControllercreatepasswordfailedaddCredential（添加口令成功）com。ohos。settingsIA00500〔Settings〕：SettingsPasswordInputControllerpasswordOnChangein。com。ohos。settingsIA00500〔Settings〕：SettingsPasswordInputControllercheckInputDigitsin。com。ohos。settingsIA00500〔Settings〕：SettingsPasswordCheckerisNumber6in。com。ohos。settingsIA00500〔Settings〕：SettingsPasswordModeladdPinCredentialin。com。ohos。settingsIA00500〔Settings〕：SettingsPasswordModeladdPinCredentialout。com。ohos。settingsIA00500〔Settings〕：SettingsPasswordInputControllerpasswordOnChangeout。进入服务层com。ohos。settingsIC02441PINAUTHSDK：〔OnRemoteRequestinputergetdatastub。cpp：29〕cmd1，flags0com。ohos。settingsIC02441PINAUTHSDK：〔OnGetDatainputergetdataservice。cpp：34〕start进入app层回调com。ohos。settingsDA00500〔Settings〕：SettingsPasswordModelencodeToU8Ain。com。ohos。settingsDA00500〔Settings〕：SettingsPasswordModelencodeToU8Aout。com。ohos。settingsIA00500〔Settings〕：SettingsPasswordModelbeforesetdata，type：10000。进入服务层com。ohos。settingsIC02441PINAUTHSDK：〔OnSetDatainputerdataimpl。cpp：37〕startanddatasizeis6com。ohos。settingsIC02441PINAUTHSDK：〔GetScryptscrypt。cpp：36〕startcom。ohos。settingsIC02441PINAUTHSDK：〔OnSetDatainputersetdataproxy。cpp：27〕startcom。ohos。settingsIC02441PINAUTHSDK：〔SendRequestinputersetdataproxy。cpp：51〕code1com。ohos。settingsIC02441PINAUTHSDK：〔OnSetDatainputersetdataproxy。cpp：45〕result0com。ohos。settingsIC02441PINAUTHSDK：〔OnRemoteRequestinputergetdatastub。cpp：29〕cmd1，flags0com。ohos。settingsIC02441PINAUTHSDK：〔OnGetDatainputergetdataservice。cpp：34〕starcom。ohos。settingsIC02441PINAUTHSDK：〔OnSetDatainputerdataimpl。cpp：37〕startanddatasizeis6com。ohos。settingsIC02441PINAUTHSDK：〔GetScryptscrypt。cpp：36〕startcom。ohos。settingsIC02441PINAUTHSDK：〔OnSetDatainputersetdataproxy。cpp：27〕startcom。ohos。settingsIC02441PINAUTHSDK：〔SendRequestinputersetdataproxy。cpp：51〕code1com。ohos。settingsIC02441PINAUTHSDK：〔OnSetDatainputersetdataproxy。cpp：45〕result0com。ohos。settingsDC02421USERAUTHSA：〔Implattributes。cpp：157〕emplacepairsuccess，typeis100025com。ohos。settingsIA00500〔Settings〕：SettingsPasswordModelAddpincredential，result：0com。ohos。settingsIA00500〔Settings〕：SettingsPasswordInputControllercreatepasswordsuccess
　　小结用户鉴权（包括屏保）是以accountmgr服务为入口为应用层提供功能，以useridm为实现，完成具体的口令管理和人脸管理。PS：人脸管理目前还有欠缺，现在设置里的人脸认证需要先设置口令为123456，然后才开始人脸认证，但是经使用人脸认证时候虽然摄像头是好的但是没有图像，可能是应用的Bug吧。用户鉴权是系统级服务，要求：ohos。permission。MANAGEUSERIDMohos。permission。USEUSERIDMohos。permission。MANAGELOCALACCOUNTSohos。permission。ACCESSUSERAUTHINTERNALohos。permission。ACCESSPINAUTH权限selinux权限（富设备支持）
　　作者：王石