Руководства

Android security plugin

A Gradle plugin for creating, downloading, and integrating the AppsFlyer Security SDK

Предложить правки

Android SDK Security Module

Обзор

This document describes the integration step for the AppsFlyer SDK Security module.

Minimum Versions

Ensure your project meets the following minimum versions for compatibility with the AppsFlyer Security module:

Before You Begin

  1. Please send all the certificate hashes (SHA-256) of all the certificates with which you sign your app to AppsFlyer.
    This includes the debug and release certificate hashes. The certificate hashes are needed to pre-build the version of the security module that your app will use.

    Instructions of getting the certificates can be found here.

  2. Make sure to ask the following information from your contact person at AppsFlyer:

    1. Maven repository name
    2. Maven Auth token
    3. Latest SDK Security module version that was built for your app.

Интеграция

Please follow the next two steps. Once completed and the dependency is downloaded successfully, the AppsFlyer native Android SDK will use the Security module automatically.

Step 1

The artifacts are hosted on AppsFlyer infrastructure.
You first need to add the your dedicated repository on AppsFlyer Maven as a repository source in your settings.gradle or settings.gradle.kts file:

dependencyResolutionManagement {
    repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
    repositories {
        mavenCentral()
        maven {
            // replace YOUR_APPSFLYER_MAVEN_REPO_ID with your AppsFlyer Maven Repo ID (starting with af-rn-)
            url "https://art.af-sdk.io/maven/${YOUR_APPSFLYER_MAVEN_REPO_ID}"
            credentials(HttpHeaderCredentials) {
                name = 'af-security-sdk-token'
                // get the token from the environment variable
                value = System.getenv("APPSFLYER_MAVEN_TOKEN")
            }
            authentication {
                header(HttpHeaderAuthentication)
            }
            content { 
                includeGroup "com.appsflyer.security" 
            }
        }
        // other repositories...
    }
}

dependencyResolutionManagement {
    repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)    
    repositories {
      mavenCentral()
        maven {
            // replace YOUR_APPSFLYER_MAVEN_REPO_ID with your AppsFlyer Maven Repo ID (starting with af-rn-)
            url = uri("https://art.af-sdk.io/maven/${YOUR_APPSFLYER_MAVEN_REPO_ID}")
            credentials(HttpHeaderCredentials::class) {
                name = "af-security-sdk-token"
                // get the token from the environment variable
                value = System.getenv("APPSFLYER_MAVEN_TOKEN")
            }
            authentication {
                create<HttpHeaderAuthentication>("header")
            }
            content {
                includeGroup("com.appsflyer.security")
            }
        }
        // other repositories...
    }
}

Step 2

Apply the Security module dependency in your app-level Gradle file.
Usually <project>/<app-module>/build.gradle or <project>/<app-module>/build.gradle.kts file

dependencies{
    // replace <YOUR_APP_ID> with your App ID and <SECURITY_SDK_VERSION> with the version of the Security module   
    implementation 'com.appsflyer.security:af-security-sdk-<YOUR_APP_ID>:<SECURITY_SDK_VERSION>'
}

dependencies{
    // replace <YOUR_APP_ID> with your App ID and <SECURITY_SDK_VERSION> with the version of the Security SDK   
    implementation("com.appsflyer.security:af-security-sdk-<YOUR_APP_ID>:<SECURITY_SDK_VERSION>")
}

Вопросы и ответы

Q: How do I know what version of SDK Security module I should use?
A: In general, you should use the latest version available for your app, that will be provided to you during the onboarding process. If you need the full list of versions available, please ask your contact person at AppsFlyer to provide it to you.

Q: How do I get a new Security module version for my app?
A: Please ask your contact person at AppsFlyer to submit a build request on your behalf, and we will provide you with a new version name to integrate.

Q: If I need to rotate my AppsFlyer Maven Auth token, how do I do that?
A: Please ask your contact person at AppsFlyer to rotate your AppsFlyer Maven Auth token, and we will provide you with a new token.

Создание отпечатка SHA256

Debug

Чтобы сгенерировать отпечаток SHA256:

  1. Locate your app's keystore.
    While developing your app, a default debug keystore is used unless specified differently in your Gradle configuration.
    The default debug.keystore location is:
  • Для пользователей Windows: C:\Users\USERNAME\.android\debug.keystore
  • Для пользователей Linux или Mac OS: ~/.android/debug.keystore
  1. Откройте командную строку и перейдите в папку, в которой находится файл хранилища ключей.
  2. Выполните следующую команду:
// keytool -list -v -keystore KEY_STORE_FILE
// For example, the default keystore file 
keytool -list -v -keystore ~/.android/debug.keystore

🚧

В качестве пароля для debug.keystore, как правило, используется "android".

Результат должен выглядеть примерно так:

Alias name: test
Creation date: Sep 27, 2017
Entry type: PrivateKeyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=myname
Issuer: CN=myname
Serial number: 365ead6d
Valid from: Wed Sep 27 17:53:32 IDT 2017 until: Sun Sep 21 17:53:32 IDT 2042
Certificate fingerprints:
MD5: DB:71:C3:FC:1A:42:ED:06:AC:45:2B:6D:23:F9:F1:24
SHA1: AE:4F:5F:24:AC:F9:49:07:8D:56:54:F0:33:56:48:F7:FE:3C:E1:60
SHA256: A9:EA:2F:A7:F1:12:AC:02:31:C3:7A:90:7C:CA:4B:CF:C3:21:6E:A7:F0:0D:60:64:4F:4B:5B:2A:D3:E1:86:C9
Signature algorithm name: SHA256withRSA
Version: 3
Extensions:
#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
  KeyIdentifier [
   0000: 34 58 91 8C 02 7F 1A 0F  0D 3B 9F 65 66 D8 E8 65 
   0010: 74 42 2D 44                    
 ]
]
  1. Send the SHA256 to AppsFlyer.

Release

🚧

If your release build is not signed by Google Play, follow the debug instruction with your production key.

When using app signing by Google Play, Google manages and protects your app's signing key for you and signs your APKs on your behalf. In this case it is required that you provide the certificate hash for the signing key used by Google using this option. This is always the case when you distribute Android app bundles.

  1. In Google Play console Find the public SHA256 fingerprint in Setup -> App signing (see image below)
  2. Send the SHA256 certificate fingerprint to AppsFlyer.

Изменения сохранены 26 дней назад