MOB SDK: MASFoundation.Android issue after Android api 28 sdk does not enforce a local pin

Products

• CA Mobile API Gateway
• CA Rapid App Security

Issue/Introduction

In the older versions/API’s of Android the SDK handled the “no local pin set” issue with a popup indicating this message and directing the user to the settings page in Android.

Is this functionality no longer being handled by the SDK and is it something that will need to be catered for within the application? 

• On Android API 26 & 27 when the user logs in “MASUser.LoginAsync(username, password)” and no local device pin is set you are presented with the  screen to set the PIN if it is not set already 
• On Android API 28 onwards when the user logs in “MASUser.LoginAsync(username, password)” and no pin is set you are presented with the following device name screen (no device pin pop up is shown to handle the local authentication as was done on the older API versions)

Environment

Release : 4.2

Component : MOBILE API

Resolution

The MOB + SDK  engineering team has looked at this and enforcing the pin for secure storage was never done by the SDK , it was android who enforced it when you try to access the secure storage.

There are some changes in android in api 28 which are causing  that the pin is not enforced anymore.

This pop is a android os system popup ,whenever the app uses any feature of local storage, then the android OS checks, if the pin is set. If not set it will show this popup.

After API 28 android does not do this anymore ,which is not a bug in the SDK and this needs to be handled in the App .