Merge changes from topic "biometric-prompt-service"

* changes:
  Add BiometricPromptService
  Remove common biometric directory

12 files changed, 368 insertions, 410 deletions

diff --git a/core/java/android/content/Context.java b/core/java/android/content/Context.java
index a352e84b060e..4fb21f3ad5e3 100644
--- a/core/java/android/content/Context.java
+++ b/core/java/android/content/Context.java
@@ -3672,6 +3672,15 @@ public abstract class Context {
     public static final String AUDIO_SERVICE = "audio";
 
     /**
+     * Use with {@link #getSystemService(String)}
+     *
+     * @hide
+     * @see #getSystemService(String)
+     * @see com.android.server.biometrics.BiometricPromptService
+     */
+    public static final String BIOMETRIC_PROMPT_SERVICE = "biometric_prompt";
+
+    /**
      * Use with {@link #getSystemService(String)} to retrieve a
      * {@link android.hardware.fingerprint.FingerprintManager} for handling management
      * of fingerprints.
diff --git a/core/java/android/content/pm/PackageManager.java b/core/java/android/content/pm/PackageManager.java
index ac2f1ce7a1f5..7d8ff4c3d0c8 100644
--- a/core/java/android/content/pm/PackageManager.java
+++ b/core/java/android/content/pm/PackageManager.java
@@ -2281,6 +2281,14 @@ public abstract class PackageManager {
 
     /**
      * Feature for {@link #getSystemAvailableFeatures} and
+     * {@link #hasSystemFeature}: The device has biometric hardware to perform iris authentication.
+     * @hide
+     */
+    @SdkConstant(SdkConstantType.FEATURE)
+    public static final String FEATURE_IRIS = "android.hardware.iris";
+
+    /**
+     * Feature for {@link #getSystemAvailableFeatures} and
      * {@link #hasSystemFeature}: The device supports portrait orientation
      * screens.  For backwards compatibility, you can assume that if neither
      * this nor {@link #FEATURE_SCREEN_LANDSCAPE} is set then the device supports
diff --git a/core/java/android/hardware/biometrics/BiometricAuthenticator.java b/core/java/android/hardware/biometrics/BiometricAuthenticator.java
index e7c5116e5f6c..59195dc903f7 100644
--- a/core/java/android/hardware/biometrics/BiometricAuthenticator.java
+++ b/core/java/android/hardware/biometrics/BiometricAuthenticator.java
@@ -161,12 +161,6 @@ public interface BiometricAuthenticator {
         public void onAuthenticationHelp(int helpCode, CharSequence helpString) {}
 
         /**
-         * Called when a biometric is recognized.
-         * @param result An object containing authentication-related data
-         */
-        public void onAuthenticationSucceeded(AuthenticationResult result) {}
-
-        /**
          * Called when a biometric is valid but not recognized.
          */
         public void onAuthenticationFailed() {}
@@ -179,6 +173,29 @@ public interface BiometricAuthenticator {
     };
 
     /**
+     * @return true if the biometric hardware is detected.
+     */
+    default boolean isHardwareDetected() {
+        throw new UnsupportedOperationException("Stub!");
+    }
+
+    /**
+     * @return true if the user has enrolled templates for this biometric.
+     */
+    default boolean hasEnrolledTemplates() {
+        throw new UnsupportedOperationException("Stub!");
+    }
+
+    /**
+     * @param error
+     * @param vendorCode
+     * @return the error string associated with this error
+     */
+    default String getErrorString(int error, int vendorCode) {
+        throw new UnsupportedOperationException("Stub!");
+    }
+
+    /**
      * This call warms up the hardware and starts scanning for valid biometrics. It terminates
      * when {@link AuthenticationCallback#onAuthenticationError(int,
      * CharSequence)} is called or when {@link AuthenticationCallback#onAuthenticationSucceeded(
@@ -198,10 +215,12 @@ public interface BiometricAuthenticator {
      * @param executor An executor to handle callback events
      * @param callback An object to receive authentication events
      */
-    void authenticate(@NonNull CryptoObject crypto,
+    default void authenticate(@NonNull CryptoObject crypto,
             @NonNull CancellationSignal cancel,
             @NonNull @CallbackExecutor Executor executor,
-            @NonNull AuthenticationCallback callback);
+            @NonNull AuthenticationCallback callback) {
+        throw new UnsupportedOperationException("Stub!");
+    }
 
     /**
      * This call warms up the hardware and starts scanning for valid biometrics. It terminates
@@ -221,7 +240,9 @@ public interface BiometricAuthenticator {
      * @param executor An executor to handle callback events
      * @param callback An object to receive authentication events
      */
-    void authenticate(@NonNull CancellationSignal cancel,
+    default void authenticate(@NonNull CancellationSignal cancel,
             @NonNull @CallbackExecutor Executor executor,
-            @NonNull AuthenticationCallback callback);
+            @NonNull AuthenticationCallback callback) {
+        throw new UnsupportedOperationException("Stub!");
+    }
 }
diff --git a/core/java/android/hardware/biometrics/BiometricConstants.java b/core/java/android/hardware/biometrics/BiometricConstants.java
index f83e847755b5..6150be361ef2 100644
--- a/core/java/android/hardware/biometrics/BiometricConstants.java
+++ b/core/java/android/hardware/biometrics/BiometricConstants.java
@@ -175,5 +175,5 @@ public interface BiometricConstants {
     /**
      * @hide
      */
-    int BIOMETRICT_ACQUIRED_VENDOR_BASE = 1000;
+    int BIOMETRIC_ACQUIRED_VENDOR_BASE = 1000;
 }
diff --git a/core/java/android/hardware/biometrics/BiometricFaceConstants.java b/core/java/android/hardware/biometrics/BiometricFaceConstants.java
index 4aa1e760c635..c788bc527205 100644
--- a/core/java/android/hardware/biometrics/BiometricFaceConstants.java
+++ b/core/java/android/hardware/biometrics/BiometricFaceConstants.java
@@ -229,7 +229,8 @@ public interface BiometricFaceConstants {
      *
      * @hide
      */
-    public static final int FACE_ACQUIRED_VENDOR = 13;
+    public static final int FACE_ACQUIRED_VENDOR = 14;
+
     /**
      * @hide
      */
diff --git a/core/java/android/hardware/biometrics/BiometricPrompt.java b/core/java/android/hardware/biometrics/BiometricPrompt.java
index 02bcff546b10..1cca27d158ab 100644
--- a/core/java/android/hardware/biometrics/BiometricPrompt.java
+++ b/core/java/android/hardware/biometrics/BiometricPrompt.java
@@ -20,14 +20,20 @@ import static android.Manifest.permission.USE_BIOMETRIC;
 
 import android.annotation.CallbackExecutor;
 import android.annotation.NonNull;
+import android.annotation.Nullable;
 import android.annotation.RequiresPermission;
 import android.content.Context;
 import android.content.DialogInterface;
-import android.content.pm.PackageManager;
-import android.hardware.fingerprint.FingerprintManager;
+import android.os.Binder;
 import android.os.Bundle;
 import android.os.CancellationSignal;
+import android.os.IBinder;
+import android.os.RemoteException;
+import android.os.ServiceManager;
 import android.text.TextUtils;
+import android.util.Log;
+
+import com.android.internal.R;
 
 import java.security.Signature;
 import java.util.concurrent.Executor;
@@ -40,6 +46,8 @@ import javax.crypto.Mac;
  */
 public class BiometricPrompt implements BiometricAuthenticator, BiometricConstants {
 
+    private static final String TAG = "BiometricPrompt";
+
     /**
      * @hide
      */
@@ -208,11 +216,23 @@ public class BiometricPrompt implements BiometricAuthenticator, BiometricConstan
         }
     }
 
-    private PackageManager mPackageManager;
-    private FingerprintManager mFingerprintManager;
-    private Bundle mBundle;
-    private ButtonInfo mPositiveButtonInfo;
-    private ButtonInfo mNegativeButtonInfo;
+    private class OnAuthenticationCancelListener implements CancellationSignal.OnCancelListener {
+        @Override
+        public void onCancel() {
+            cancelAuthentication();
+        }
+    }
+
+    private final IBinder mToken = new Binder();
+    private final Context mContext;
+    private final IBiometricPromptService mService;
+    private final Bundle mBundle;
+    private final ButtonInfo mPositiveButtonInfo;
+    private final ButtonInfo mNegativeButtonInfo;
+
+    private CryptoObject mCryptoObject;
+    private Executor mExecutor;
+    private AuthenticationCallback mAuthenticationCallback;
 
     IBiometricPromptReceiver mDialogReceiver = new IBiometricPromptReceiver.Stub() {
         @Override
@@ -230,13 +250,48 @@ public class BiometricPrompt implements BiometricAuthenticator, BiometricConstan
         }
     };
 
+    IBiometricPromptServiceReceiver mBiometricPromptServiceReceiver =
+            new IBiometricPromptServiceReceiver.Stub() {
+
+        @Override
+        public void onAuthenticationSucceeded(long deviceId) throws RemoteException {
+            mExecutor.execute(() -> {
+                final AuthenticationResult result = new AuthenticationResult(mCryptoObject);
+                mAuthenticationCallback.onAuthenticationSucceeded(result);
+            });
+        }
+
+        @Override
+        public void onAuthenticationFailed(long deviceId) throws RemoteException {
+            mExecutor.execute(() -> {
+                mAuthenticationCallback.onAuthenticationFailed();
+            });
+        }
+
+        @Override
+        public void onError(long deviceId, int error, String message)
+                throws RemoteException {
+            mExecutor.execute(() -> {
+                mAuthenticationCallback.onAuthenticationError(error, message);
+            });
+        }
+
+        @Override
+        public void onAcquired(long deviceId, int acquireInfo, String message) {
+            mExecutor.execute(() -> {
+                mAuthenticationCallback.onAuthenticationHelp(acquireInfo, message);
+            });
+        }
+    };
+
     private BiometricPrompt(Context context, Bundle bundle,
             ButtonInfo positiveButtonInfo, ButtonInfo negativeButtonInfo) {
+        mContext = context;
         mBundle = bundle;
         mPositiveButtonInfo = positiveButtonInfo;
         mNegativeButtonInfo = negativeButtonInfo;
-        mFingerprintManager = context.getSystemService(FingerprintManager.class);
-        mPackageManager = context.getPackageManager();
+        mService = IBiometricPromptService.Stub.asInterface(
+                ServiceManager.getService(Context.BIOMETRIC_PROMPT_SERVICE));
     }
 
     /**
@@ -290,13 +345,12 @@ public class BiometricPrompt implements BiometricAuthenticator, BiometricConstan
         /**
          * Authentication result
          * @param crypto
-         * @param identifier
-         * @param userId
          * @hide
          */
-        public AuthenticationResult(CryptoObject crypto, Identifier identifier,
-                int userId) {
-            super(crypto, identifier, userId);
+        public AuthenticationResult(CryptoObject crypto) {
+            // For compatibility, this extends from common base class as FingerprintManager does.
+            // Identifier and userId is not used for BiometricPrompt.
+            super(crypto, null /* identifier */, 0 /* userId */);
         }
         /**
          * Obtain the crypto object associated with this transaction
@@ -353,53 +407,6 @@ public class BiometricPrompt implements BiometricAuthenticator, BiometricConstan
          */
         @Override
         public void onAuthenticationAcquired(int acquireInfo) {}
-
-        /**
-         * @param result An object containing authentication-related data
-         * @hide
-         */
-        @Override
-        public void onAuthenticationSucceeded(BiometricAuthenticator.AuthenticationResult result) {
-            onAuthenticationSucceeded(new AuthenticationResult(
-                    (CryptoObject) result.getCryptoObject(),
-                    result.getId(),
-                    result.getUserId()));
-        }
-    }
-
-    /**
-     * @param crypto Object associated with the call
-     * @param cancel An object that can be used to cancel authentication
-     * @param executor An executor to handle callback events
-     * @param callback An object to receive authentication events
-     * @hide
-     */
-    @Override
-    public void authenticate(@NonNull android.hardware.biometrics.CryptoObject crypto,
-            @NonNull CancellationSignal cancel,
-            @NonNull @CallbackExecutor Executor executor,
-            @NonNull BiometricAuthenticator.AuthenticationCallback callback) {
-        if (!(callback instanceof BiometricPrompt.AuthenticationCallback)) {
-            throw new IllegalArgumentException("Callback cannot be casted");
-        }
-        authenticate(crypto, cancel, executor, (AuthenticationCallback) callback);
-    }
-
-    /**
-     *
-     * @param cancel An object that can be used to cancel authentication
-     * @param executor An executor to handle callback events
-     * @param callback An object to receive authentication events
-     * @hide
-     */
-    @Override
-    public void authenticate(@NonNull CancellationSignal cancel,
-            @NonNull @CallbackExecutor Executor executor,
-            @NonNull BiometricAuthenticator.AuthenticationCallback callback) {
-        if (!(callback instanceof BiometricPrompt.AuthenticationCallback)) {
-            throw new IllegalArgumentException("Callback cannot be casted");
-        }
-        authenticate(cancel, executor, (AuthenticationCallback) callback);
     }
 
     /**
@@ -430,11 +437,19 @@ public class BiometricPrompt implements BiometricAuthenticator, BiometricConstan
             @NonNull CancellationSignal cancel,
             @NonNull @CallbackExecutor Executor executor,
             @NonNull AuthenticationCallback callback) {
-        if (handlePreAuthenticationErrors(callback, executor)) {
-            return;
+        if (crypto == null) {
+            throw new IllegalArgumentException("Must supply a crypto object");
         }
-        mFingerprintManager.authenticate(crypto, cancel, mBundle, executor, mDialogReceiver,
-                callback);
+        if (cancel == null) {
+            throw new IllegalArgumentException("Must supply a cancellation signal");
+        }
+        if (executor == null) {
+            throw new IllegalArgumentException("Must supply an executor");
+        }
+        if (callback == null) {
+            throw new IllegalArgumentException("Must supply a callback");
+        }
+        authenticateInternal(crypto, cancel, executor, callback);
     }
 
     /**
@@ -462,34 +477,53 @@ public class BiometricPrompt implements BiometricAuthenticator, BiometricConstan
     public void authenticate(@NonNull CancellationSignal cancel,
             @NonNull @CallbackExecutor Executor executor,
             @NonNull AuthenticationCallback callback) {
-        if (handlePreAuthenticationErrors(callback, executor)) {
-            return;
+        if (cancel == null) {
+            throw new IllegalArgumentException("Must supply a cancellation signal");
+        }
+        if (executor == null) {
+            throw new IllegalArgumentException("Must supply an executor");
         }
-        mFingerprintManager.authenticate(cancel, mBundle, executor, mDialogReceiver, callback);
+        if (callback == null) {
+            throw new IllegalArgumentException("Must supply a callback");
+        }
+        authenticateInternal(null /* crypto */, cancel, executor, callback);
     }
 
-    private boolean handlePreAuthenticationErrors(AuthenticationCallback callback,
-            Executor executor) {
-        if (!mPackageManager.hasSystemFeature(PackageManager.FEATURE_FINGERPRINT)) {
-            sendError(BiometricPrompt.BIOMETRIC_ERROR_HW_NOT_PRESENT, callback,
-                      executor);
-            return true;
-        } else if (!mFingerprintManager.isHardwareDetected()) {
-            sendError(BiometricPrompt.BIOMETRIC_ERROR_HW_UNAVAILABLE, callback,
-                      executor);
-            return true;
-        } else if (!mFingerprintManager.hasEnrolledFingerprints()) {
-            sendError(BiometricPrompt.BIOMETRIC_ERROR_NO_BIOMETRICS, callback,
-                      executor);
-            return true;
+    private void cancelAuthentication() {
+        if (mService != null) {
+            try {
+                mService.cancelAuthentication(mToken, mContext.getOpPackageName());
+            } catch (RemoteException e) {
+                Log.e(TAG, "Unable to cancel authentication", e);
+            }
         }
-        return false;
     }
 
-    private void sendError(int error, AuthenticationCallback callback, Executor executor) {
-        executor.execute(() -> {
-            callback.onAuthenticationError(error, mFingerprintManager.getErrorString(
-                    error, 0 /* vendorCode */));
-        });
+    private void authenticateInternal(@Nullable CryptoObject crypto,
+            @NonNull CancellationSignal cancel,
+            @NonNull @CallbackExecutor Executor executor,
+            @NonNull AuthenticationCallback callback) {
+        try {
+            if (cancel.isCanceled()) {
+                Log.w(TAG, "Authentication already canceled");
+                return;
+            } else {
+                cancel.setOnCancelListener(new OnAuthenticationCancelListener());
+            }
+
+            mCryptoObject = crypto;
+            mExecutor = executor;
+            mAuthenticationCallback = callback;
+            final long sessionId = crypto != null ? crypto.getOpId() : 0;
+            mService.authenticate(mToken, sessionId, mContext.getUserId(),
+                    mBiometricPromptServiceReceiver, 0 /* flags */, mContext.getOpPackageName(),
+                    mBundle, mDialogReceiver);
+        } catch (RemoteException e) {
+            Log.e(TAG, "Remote exception while authenticating", e);
+            mExecutor.execute(() -> {
+                callback.onAuthenticationError(BiometricPrompt.BIOMETRIC_ERROR_HW_UNAVAILABLE,
+                        mContext.getString(R.string.biometric_error_hw_unavailable));
+            });
+        }
     }
 }
diff --git a/core/java/android/hardware/biometrics/IBiometricPromptService.aidl b/core/java/android/hardware/biometrics/IBiometricPromptService.aidl
new file mode 100644
index 000000000000..2c93579bc8bd
--- /dev/null
+++ b/core/java/android/hardware/biometrics/IBiometricPromptService.aidl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.biometrics;
+
+import android.os.Bundle;
+import android.hardware.biometrics.IBiometricPromptReceiver;
+import android.hardware.biometrics.IBiometricPromptServiceReceiver;
+
+/**
+ * Communication channel from BiometricPrompt to BiometricPromptService. The interface does not
+ * expose specific biometric modalities. The system will use the default biometric for apps. On
+ * devices with more than one, the choice is dictated by user preference in Settings.
+ * @hide
+ */
+interface IBiometricPromptService {
+    // Requests authentication. The service choose the appropriate biometric to use, and show
+    // the corresponding BiometricDialog.
+    void authenticate(IBinder token, long sessionId, int userId,
+            IBiometricPromptServiceReceiver receiver, int flags, String opPackageName,
+            in Bundle bundle, IBiometricPromptReceiver dialogReceiver);
+
+    // Cancel authentication for the given sessionId
+    void cancelAuthentication(IBinder token, String opPackageName);
+}
\ No newline at end of file
diff --git a/core/java/android/hardware/biometrics/IBiometricPromptServiceReceiver.aidl b/core/java/android/hardware/biometrics/IBiometricPromptServiceReceiver.aidl
new file mode 100644
index 000000000000..1ef6c52c1594
--- /dev/null
+++ b/core/java/android/hardware/biometrics/IBiometricPromptServiceReceiver.aidl
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.biometrics;
+
+import android.hardware.biometrics.BiometricSourceType;
+import android.os.Bundle;
+import android.os.UserHandle;
+
+/**
+ * Communication channel from the BiometricPromptService back to BiometricPrompt.
+ * @hide
+ */
+oneway interface IBiometricPromptServiceReceiver {
+    void onAuthenticationSucceeded(long deviceId);
+    void onAuthenticationFailed(long deviceId);
+    void onError(long deviceId, int error, String message);
+    void onAcquired(long deviceId, int acquiredInfo, String message);
+}
diff --git a/core/java/android/hardware/face/FaceManager.java b/core/java/android/hardware/face/FaceManager.java
index 6a3dd7dd0693..b3b962f0aca8 100644
--- a/core/java/android/hardware/face/FaceManager.java
+++ b/core/java/android/hardware/face/FaceManager.java
@@ -17,10 +17,9 @@
 package android.hardware.face;
 
 import static android.Manifest.permission.INTERACT_ACROSS_USERS;
-import static android.Manifest.permission.MANAGE_FACE;
-import static android.Manifest.permission.USE_BIOMETRIC;
+import static android.Manifest.permission.MANAGE_BIOMETRIC;
+import static android.Manifest.permission.USE_BIOMETRIC_INTERNAL;
 
-import android.annotation.CallbackExecutor;
 import android.annotation.NonNull;
 import android.annotation.Nullable;
 import android.annotation.RequiresPermission;
@@ -28,13 +27,11 @@ import android.annotation.SystemService;
 import android.app.ActivityManager;
 import android.content.Context;
 import android.hardware.biometrics.BiometricAuthenticator;
+import android.hardware.biometrics.BiometricConstants;
 import android.hardware.biometrics.BiometricFaceConstants;
-import android.hardware.biometrics.BiometricPrompt;
 import android.hardware.biometrics.CryptoObject;
-import android.hardware.biometrics.IBiometricPromptReceiver;
 import android.hardware.biometrics.IBiometricServiceLockoutResetCallback;
 import android.os.Binder;
-import android.os.Bundle;
 import android.os.CancellationSignal;
 import android.os.CancellationSignal.OnCancelListener;
 import android.os.Handler;
@@ -50,15 +47,13 @@ import android.util.Slog;
 import com.android.internal.R;
 
 import java.util.List;
-import java.util.concurrent.Executor;
 
 /**
  * A class that coordinates access to the face authentication hardware.
  * @hide
  */
 @SystemService(Context.FACE_SERVICE)
-public class FaceManager implements BiometricFaceConstants {
-
+public class FaceManager implements BiometricAuthenticator, BiometricFaceConstants {
 
     private static final String TAG = "FaceManager";
     private static final boolean DEBUG = true;
@@ -72,13 +67,12 @@ public class FaceManager implements BiometricFaceConstants {
     private IFaceService mService;
     private final Context mContext;
     private IBinder mToken = new Binder();
-    private BiometricAuthenticator.AuthenticationCallback mAuthenticationCallback;
+    private AuthenticationCallback mAuthenticationCallback;
     private EnrollmentCallback mEnrollmentCallback;
     private RemovalCallback mRemovalCallback;
     private CryptoObject mCryptoObject;
     private Face mRemovalFace;
     private Handler mHandler;
-    private Executor mExecutor;
 
     private IFaceServiceReceiver mServiceReceiver = new IFaceServiceReceiver.Stub() {
 
@@ -147,7 +141,7 @@ public class FaceManager implements BiometricFaceConstants {
      * @throws IllegalStateException    if the crypto primitive is not initialized.
      * @hide
      */
-    @RequiresPermission(USE_BIOMETRIC)
+    @RequiresPermission(USE_BIOMETRIC_INTERNAL)
     public void authenticate(@Nullable CryptoObject crypto, @Nullable CancellationSignal cancel,
             int flags, @NonNull AuthenticationCallback callback, @Nullable Handler handler) {
         if (callback == null) {
@@ -170,7 +164,7 @@ public class FaceManager implements BiometricFaceConstants {
                 mCryptoObject = crypto;
                 long sessionId = crypto != null ? crypto.getOpId() : 0;
                 mService.authenticate(mToken, sessionId, mServiceReceiver, flags,
-                        mContext.getOpPackageName(), null /* bundle */, null /* receiver */);
+                        mContext.getOpPackageName());
             } catch (RemoteException e) {
                 Log.w(TAG, "Remote exception while authenticating: ", e);
                 if (callback != null) {
@@ -195,108 +189,6 @@ public class FaceManager implements BiometricFaceConstants {
     }
 
     /**
-     * This method invokes the BiometricPrompt.
-     */
-    private void authenticateWithPrompt(@Nullable android.hardware.biometrics.CryptoObject crypto,
-            @NonNull CancellationSignal cancel,
-            @NonNull Bundle bundle,
-            @NonNull @CallbackExecutor Executor executor,
-            @NonNull IBiometricPromptReceiver receiver,
-            @NonNull BiometricAuthenticator.AuthenticationCallback callback) {
-        mCryptoObject = crypto;
-        if (cancel.isCanceled()) {
-            Slog.w(TAG, "authentication already canceled");
-            return;
-        } else {
-            cancel.setOnCancelListener(new OnAuthenticationCancelListener(crypto));
-        }
-
-        if (mService != null) {
-            try {
-                mExecutor = executor;
-                mAuthenticationCallback = callback;
-                final long sessionId = crypto != null ? crypto.getOpId() : 0;
-                mService.authenticate(mToken, sessionId, mServiceReceiver,
-                        0 /* flags */, mContext.getOpPackageName(), bundle, receiver);
-            } catch (RemoteException e) {
-                Slog.w(TAG, "Remote exception while authenticating", e);
-                mExecutor.execute(() -> {
-                    callback.onAuthenticationError(FACE_ERROR_HW_UNAVAILABLE,
-                            getErrorString(FACE_ERROR_HW_UNAVAILABLE, 0 /* vendorCode */));
-                });
-            }
-        }
-    }
-
-    /**
-     * Private method, see {@link BiometricPrompt#authenticate(CancellationSignal, Executor,
-     * BiometricPrompt.AuthenticationCallback)}
-     * @param cancel
-     * @param executor
-     * @param callback
-     * @hide
-     */
-    public void authenticate(
-            @NonNull CancellationSignal cancel,
-            @NonNull Bundle bundle,
-            @NonNull @CallbackExecutor Executor executor,
-            @NonNull IBiometricPromptReceiver receiver,
-            @NonNull BiometricAuthenticator.AuthenticationCallback callback) {
-        if (cancel == null) {
-            throw new IllegalArgumentException("Must supply a cancellation signal");
-        }
-        if (bundle == null) {
-            throw new IllegalArgumentException("Must supply a bundle");
-        }
-        if (executor == null) {
-            throw new IllegalArgumentException("Must supply an executor");
-        }
-        if (receiver == null) {
-            throw new IllegalArgumentException("Must supply a receiver");
-        }
-        if (callback == null) {
-            throw new IllegalArgumentException("Must supply a calback");
-        }
-        authenticateWithPrompt(null, cancel, bundle, executor, receiver, callback);
-    }
-
-    /**
-     * Private method, see {@link BiometricPrompt#authenticate(BiometricPrompt.CryptoObject,
-     * CancellationSignal, Executor, BiometricPrompt.AuthenticationCallback)}
-     * @param crypto
-     * @param cancel
-     * @param executor
-     * @param callback
-     * @hide
-     */
-    public void authenticate(@NonNull android.hardware.biometrics.CryptoObject crypto,
-            @NonNull CancellationSignal cancel,
-            @NonNull Bundle bundle,
-            @NonNull @CallbackExecutor Executor executor,
-            @NonNull IBiometricPromptReceiver receiver,
-            @NonNull BiometricAuthenticator.AuthenticationCallback callback) {
-        if (crypto == null) {
-            throw new IllegalArgumentException("Must supply a crypto object");
-        }
-        if (cancel == null) {
-            throw new IllegalArgumentException("Must supply a cancellation signal");
-        }
-        if (bundle == null) {
-            throw new IllegalArgumentException("Must supply a bundle");
-        }
-        if (executor == null) {
-            throw new IllegalArgumentException("Must supply an executor");
-        }
-        if (receiver == null) {
-            throw new IllegalArgumentException("Must supply a receiver");
-        }
-        if (callback == null) {
-            throw new IllegalArgumentException("Must supply a callback");
-        }
-        authenticateWithPrompt(crypto, cancel, bundle, executor, receiver, callback);
-    }
-
-    /**
      * Request face authentication enrollment. This call operates the face authentication hardware
      * and starts capturing images. Progress will be indicated by callbacks to the
      * {@link EnrollmentCallback} object. It terminates when
@@ -313,7 +205,7 @@ public class FaceManager implements BiometricFaceConstants {
      * @param callback an object to receive enrollment events
      * @hide
      */
-    @RequiresPermission(MANAGE_FACE)
+    @RequiresPermission(MANAGE_BIOMETRIC)
     public void enroll(byte[] token, CancellationSignal cancel, int flags,
             int userId, EnrollmentCallback callback) {
         if (userId == UserHandle.USER_CURRENT) {
@@ -355,7 +247,7 @@ public class FaceManager implements BiometricFaceConstants {
      *
      * @hide
      */
-    @RequiresPermission(MANAGE_FACE)
+    @RequiresPermission(MANAGE_BIOMETRIC)
     public long preEnroll() {
         long result = 0;
         if (mService != null) {
@@ -373,7 +265,7 @@ public class FaceManager implements BiometricFaceConstants {
      *
      * @hide
      */
-    @RequiresPermission(MANAGE_FACE)
+    @RequiresPermission(MANAGE_BIOMETRIC)
     public int postEnroll() {
         int result = 0;
         if (mService != null) {
@@ -392,7 +284,7 @@ public class FaceManager implements BiometricFaceConstants {
      *
      * @hide
      */
-    @RequiresPermission(MANAGE_FACE)
+    @RequiresPermission(MANAGE_BIOMETRIC)
     public void setActiveUser(int userId) {
         if (mService != null) {
             try {
@@ -412,7 +304,7 @@ public class FaceManager implements BiometricFaceConstants {
      *                 successfully removed. May be null if no callback is required.
      * @hide
      */
-    @RequiresPermission(MANAGE_FACE)
+    @RequiresPermission(MANAGE_BIOMETRIC)
     public void remove(Face face, int userId, RemovalCallback callback) {
         if (mService != null) {
             try {
@@ -435,7 +327,7 @@ public class FaceManager implements BiometricFaceConstants {
      * @return the current face item
      * @hide
      */
-    @RequiresPermission(USE_BIOMETRIC)
+    @RequiresPermission(MANAGE_BIOMETRIC)
     public List<Face> getEnrolledFaces(int userId) {
         if (mService != null) {
             try {
@@ -453,7 +345,7 @@ public class FaceManager implements BiometricFaceConstants {
      * @return the current face item
      * @hide
      */
-    @RequiresPermission(USE_BIOMETRIC)
+    @RequiresPermission(MANAGE_BIOMETRIC)
     public List<Face> getEnrolledFaces() {
         return getEnrolledFaces(UserHandle.myUserId());
     }
@@ -463,8 +355,9 @@ public class FaceManager implements BiometricFaceConstants {
      *
      * @return true if a face is enrolled, false otherwise
      */
-    @RequiresPermission(USE_BIOMETRIC)
-    public boolean hasEnrolledFaces() {
+    @RequiresPermission(USE_BIOMETRIC_INTERNAL)
+    @Override
+    public boolean hasEnrolledTemplates() {
         if (mService != null) {
             try {
                 return mService.hasEnrolledFaces(
@@ -480,9 +373,9 @@ public class FaceManager implements BiometricFaceConstants {
      * @hide
      */
     @RequiresPermission(allOf = {
-            USE_BIOMETRIC,
+            USE_BIOMETRIC_INTERNAL,
             INTERACT_ACROSS_USERS})
-    public boolean hasEnrolledFaces(int userId) {
+    public boolean hasEnrolledTemplates(int userId) {
         if (mService != null) {
             try {
                 return mService.hasEnrolledFaces(userId, mContext.getOpPackageName());
@@ -498,7 +391,8 @@ public class FaceManager implements BiometricFaceConstants {
      *
      * @return true if hardware is present and functional, false otherwise.
      */
-    @RequiresPermission(USE_BIOMETRIC)
+    @RequiresPermission(USE_BIOMETRIC_INTERNAL)
+    @Override
     public boolean isHardwareDetected() {
         if (mService != null) {
             try {
@@ -538,6 +432,7 @@ public class FaceManager implements BiometricFaceConstants {
      * @param token an opaque token returned by password confirmation.
      * @hide
      */
+    @RequiresPermission(MANAGE_BIOMETRIC)
     public void resetTimeout(byte[] token) {
         if (mService != null) {
             try {
@@ -553,6 +448,7 @@ public class FaceManager implements BiometricFaceConstants {
     /**
      * @hide
      */
+    @RequiresPermission(USE_BIOMETRIC_INTERNAL)
     public void addLockoutResetCallback(final LockoutResetCallback callback) {
         if (mService != null) {
             try {
@@ -617,7 +513,8 @@ public class FaceManager implements BiometricFaceConstants {
         }
     }
 
-    private String getErrorString(int errMsg, int vendorCode) {
+    @Override
+    public String getErrorString(int errMsg, int vendorCode) {
         switch (errMsg) {
             case FACE_ERROR_HW_UNAVAILABLE:
                 return mContext.getString(
@@ -652,7 +549,10 @@ public class FaceManager implements BiometricFaceConstants {
         return null;
     }
 
-    private String getAcquiredString(int acquireInfo, int vendorCode) {
+    /**
+     * @hide
+     */
+    public String getAcquiredString(int acquireInfo, int vendorCode) {
         switch (acquireInfo) {
             case FACE_ACQUIRED_GOOD:
                 return null;
@@ -691,6 +591,37 @@ public class FaceManager implements BiometricFaceConstants {
     }
 
     /**
+     * Used so BiometricPrompt can map the face ones onto existing public constants.
+     * @hide
+     */
+    public int getMappedAcquiredInfo(int acquireInfo, int vendorCode) {
+        switch (acquireInfo) {
+            case FACE_ACQUIRED_GOOD:
+                return BiometricConstants.BIOMETRIC_ACQUIRED_GOOD;
+            case FACE_ACQUIRED_INSUFFICIENT:
+            case FACE_ACQUIRED_TOO_BRIGHT:
+            case FACE_ACQUIRED_TOO_DARK:
+                return BiometricConstants.BIOMETRIC_ACQUIRED_INSUFFICIENT;
+            case FACE_ACQUIRED_TOO_CLOSE:
+            case FACE_ACQUIRED_TOO_FAR:
+            case FACE_ACQUIRED_TOO_HIGH:
+            case FACE_ACQUIRED_TOO_LOW:
+            case FACE_ACQUIRED_TOO_RIGHT:
+            case FACE_ACQUIRED_TOO_LEFT:
+                return BiometricConstants.BIOMETRIC_ACQUIRED_PARTIAL;
+            case FACE_ACQUIRED_POOR_GAZE:
+            case FACE_ACQUIRED_NOT_DETECTED:
+            case FACE_ACQUIRED_TOO_MUCH_MOTION:
+            case FACE_ACQUIRED_RECALIBRATE:
+                return BiometricConstants.BIOMETRIC_ACQUIRED_INSUFFICIENT;
+            case FACE_ACQUIRED_VENDOR:
+                return BiometricConstants.BIOMETRIC_ACQUIRED_VENDOR_BASE + vendorCode;
+            default:
+                return BiometricConstants.BIOMETRIC_ACQUIRED_GOOD;
+        }
+    }
+
+    /**
      * Container for callback data from {@link FaceManager#authenticate(CryptoObject,
      * CancellationSignal, int, AuthenticationCallback, Handler)}.
      */
@@ -796,18 +727,6 @@ public class FaceManager implements BiometricFaceConstants {
          */
         public void onAuthenticationAcquired(int acquireInfo) {
         }
-
-        /**
-         * @hide
-         * @param result
-         */
-        @Override
-        public void onAuthenticationSucceeded(BiometricAuthenticator.AuthenticationResult result) {
-            onAuthenticationSucceeded(new AuthenticationResult(
-                    result.getCryptoObject(),
-                    (Face) result.getId(), result.getUserId()));
-        }
-
     }
 
     /**
@@ -988,8 +907,8 @@ public class FaceManager implements BiometricFaceConstants {
 
     private void sendAuthenticatedSucceeded(Face face, int userId) {
         if (mAuthenticationCallback != null) {
-            final BiometricAuthenticator.AuthenticationResult result =
-                    new BiometricAuthenticator.AuthenticationResult(mCryptoObject, face, userId);
+            final AuthenticationResult result =
+                    new AuthenticationResult(mCryptoObject, face, userId);
             mAuthenticationCallback.onAuthenticationSucceeded(result);
         }
     }
diff --git a/core/java/android/hardware/face/IFaceService.aidl b/core/java/android/hardware/face/IFaceService.aidl
index 03bb7aeccef3..dd995c985286 100644
--- a/core/java/android/hardware/face/IFaceService.aidl
+++ b/core/java/android/hardware/face/IFaceService.aidl
@@ -17,23 +17,35 @@ package android.hardware.face;
 
 import android.os.Bundle;
 import android.hardware.biometrics.IBiometricPromptReceiver;
+import android.hardware.biometrics.IBiometricPromptServiceReceiver;
 import android.hardware.biometrics.IBiometricServiceLockoutResetCallback;
 import android.hardware.face.IFaceServiceReceiver;
 import android.hardware.face.Face;
 
 /**
- * Communication channel from client to the face service.
+ * Communication channel from client to the face service. These methods are all require the
+ * MANAGE_BIOMETRIC signature permission.
  * @hide
  */
 interface IFaceService {
     // Authenticate the given sessionId with a face
     void authenticate(IBinder token, long sessionId,
-            IFaceServiceReceiver receiver, int flags, String opPackageName,
-            in Bundle bundle, IBiometricPromptReceiver dialogReceiver);
+            IFaceServiceReceiver receiver, int flags, String opPackageName);
+
+    // This method invokes the BiometricDialog. The arguments are almost the same as above,
+    // but should only be called from (BiometricPromptService).
+    void authenticateFromService(IBinder token, long sessionId, int userId,
+            IBiometricPromptServiceReceiver receiver, int flags, String opPackageName,
+            in Bundle bundle, IBiometricPromptReceiver dialogReceiver,
+            int callingUid, int callingPid, int callingUserId);
 
     // Cancel authentication for the given sessionId
     void cancelAuthentication(IBinder token, String opPackageName);
 
+    // Same as above, with extra arguments.
+    void cancelAuthenticationFromService(IBinder token, String opPackageName,
+            int callingUid, int callingPid, int callingUserId);
+
     // Start face enrollment
     void enroll(IBinder token, in byte [] cryptoToken, int userId, IFaceServiceReceiver receiver,
                 int flags, String opPackageName);
diff --git a/core/java/android/hardware/fingerprint/FingerprintManager.java b/core/java/android/hardware/fingerprint/FingerprintManager.java
index 15868f12eb64..44b8faf0509c 100644
--- a/core/java/android/hardware/fingerprint/FingerprintManager.java
+++ b/core/java/android/hardware/fingerprint/FingerprintManager.java
@@ -18,10 +18,10 @@ package android.hardware.fingerprint;
 
 import static android.Manifest.permission.INTERACT_ACROSS_USERS;
 import static android.Manifest.permission.MANAGE_FINGERPRINT;
+import static android.Manifest.permission.RESET_FINGERPRINT_LOCKOUT;
 import static android.Manifest.permission.USE_BIOMETRIC;
 import static android.Manifest.permission.USE_FINGERPRINT;
 
-import android.annotation.CallbackExecutor;
 import android.annotation.NonNull;
 import android.annotation.Nullable;
 import android.annotation.RequiresFeature;
@@ -34,10 +34,8 @@ import android.content.pm.PackageManager;
 import android.hardware.biometrics.BiometricAuthenticator;
 import android.hardware.biometrics.BiometricFingerprintConstants;
 import android.hardware.biometrics.BiometricPrompt;
-import android.hardware.biometrics.IBiometricPromptReceiver;
 import android.hardware.biometrics.IBiometricServiceLockoutResetCallback;
 import android.os.Binder;
-import android.os.Bundle;
 import android.os.CancellationSignal;
 import android.os.CancellationSignal.OnCancelListener;
 import android.os.Handler;
@@ -66,7 +64,8 @@ import javax.crypto.Mac;
 @Deprecated
 @SystemService(Context.FINGERPRINT_SERVICE)
 @RequiresFeature(PackageManager.FEATURE_FINGERPRINT)
-public class FingerprintManager implements BiometricFingerprintConstants {
+public class FingerprintManager implements BiometricAuthenticator, BiometricFingerprintConstants {
+
     private static final String TAG = "FingerprintManager";
     private static final boolean DEBUG = true;
     private static final int MSG_ENROLL_RESULT = 100;
@@ -80,14 +79,13 @@ public class FingerprintManager implements BiometricFingerprintConstants {
     private IFingerprintService mService;
     private Context mContext;
     private IBinder mToken = new Binder();
-    private BiometricAuthenticator.AuthenticationCallback mAuthenticationCallback;
+    private AuthenticationCallback mAuthenticationCallback;
     private EnrollmentCallback mEnrollmentCallback;
     private RemovalCallback mRemovalCallback;
     private EnumerateCallback mEnumerateCallback;
-    private android.hardware.biometrics.CryptoObject mCryptoObject;
+    private CryptoObject mCryptoObject;
     private Fingerprint mRemovalFingerprint;
     private Handler mHandler;
-    private Executor mExecutor;
 
     private class OnEnrollCancelListener implements OnCancelListener {
         @Override
@@ -250,24 +248,12 @@ public class FingerprintManager implements BiometricFingerprintConstants {
          */
         @Override
         public void onAuthenticationAcquired(int acquireInfo) {}
-
-        /**
-         * @hide
-         * @param result
-         */
-        @Override
-        public void onAuthenticationSucceeded(BiometricAuthenticator.AuthenticationResult result) {
-            onAuthenticationSucceeded(new AuthenticationResult(
-                    (CryptoObject) result.getCryptoObject(),
-                    (Fingerprint) result.getId(), result.getUserId()));
-        }
     };
 
     /**
-     * Callback structure provided to {@link FingerprintManager#enroll(long, EnrollmentCallback,
-     * CancellationSignal, int). Users of {@link #FingerprintManager()}
-     * must provide an implementation of this to {@link FingerprintManager#enroll(long,
-     * CancellationSignal, int, EnrollmentCallback) for listening to fingerprint events.
+     * Callback structure provided to {@link FingerprintManager#enroll(byte[], CancellationSignal,
+     * int, int, EnrollmentCallback)} must provide an implementation of this for listening to
+     * fingerprint events.
      *
      * @hide
      */
@@ -328,9 +314,9 @@ public class FingerprintManager implements BiometricFingerprintConstants {
     };
 
     /**
-     * Callback structure provided to {@link FingerprintManager#enumerate(int). Users of
-     * {@link #FingerprintManager()} may optionally provide an implementation of this to
-     * {@link FingerprintManager#enumerate(int, int, EnumerateCallback)} for listening to
+     * Callback structure provided to {@link FingerprintManager#enumerate(int, EnumerateCallback)}.
+     * Users of{@link #FingerprintManager} may optionally provide an implementation of this to
+     * {@link FingerprintManager#enumerate(int, EnumerateCallback)} for listening to
      * fingerprint template removal events.
      *
      * @hide
@@ -433,7 +419,7 @@ public class FingerprintManager implements BiometricFingerprintConstants {
             mCryptoObject = crypto;
             long sessionId = crypto != null ? crypto.getOpId() : 0;
             mService.authenticate(mToken, sessionId, userId, mServiceReceiver, flags,
-                    mContext.getOpPackageName(), null /* bundle */, null /* receiver */);
+                    mContext.getOpPackageName());
         } catch (RemoteException e) {
             Slog.w(TAG, "Remote exception while authenticating: ", e);
             if (callback != null) {
@@ -446,110 +432,6 @@ public class FingerprintManager implements BiometricFingerprintConstants {
     }
 
     /**
-     * Per-user version. This method invokes the BiometricPrompt.
-     */
-    private void authenticate(int userId,
-            @Nullable android.hardware.biometrics.CryptoObject crypto,
-            @NonNull CancellationSignal cancel,
-            @NonNull Bundle bundle,
-            @NonNull @CallbackExecutor Executor executor,
-            @NonNull IBiometricPromptReceiver receiver,
-            @NonNull BiometricAuthenticator.AuthenticationCallback callback) {
-        mCryptoObject = crypto;
-        if (cancel.isCanceled()) {
-            Slog.w(TAG, "authentication already canceled");
-            return;
-        } else {
-            cancel.setOnCancelListener(new OnAuthenticationCancelListener(crypto));
-        }
-
-        if (mService != null) {
-            try {
-                mExecutor = executor;
-                mAuthenticationCallback = callback;
-                final long sessionId = crypto != null ? crypto.getOpId() : 0;
-                mService.authenticate(mToken, sessionId, userId, mServiceReceiver,
-                        0 /* flags */, mContext.getOpPackageName(), bundle, receiver);
-            } catch (RemoteException e) {
-                Slog.w(TAG, "Remote exception while authenticating", e);
-                mExecutor.execute(() -> {
-                    callback.onAuthenticationError(FINGERPRINT_ERROR_HW_UNAVAILABLE,
-                            getErrorString(FINGERPRINT_ERROR_HW_UNAVAILABLE, 0 /* vendorCode */));
-                });
-            }
-        }
-    }
-
-    /**
-     * Private method, see {@link BiometricPrompt#authenticate(CancellationSignal, Executor,
-     * BiometricPrompt.AuthenticationCallback)}
-     * @param cancel
-     * @param executor
-     * @param callback
-     * @hide
-     */
-    public void authenticate(
-            @NonNull CancellationSignal cancel,
-            @NonNull Bundle bundle,
-            @NonNull @CallbackExecutor Executor executor,
-            @NonNull IBiometricPromptReceiver receiver,
-            @NonNull BiometricAuthenticator.AuthenticationCallback callback) {
-        if (cancel == null) {
-            throw new IllegalArgumentException("Must supply a cancellation signal");
-        }
-        if (bundle == null) {
-            throw new IllegalArgumentException("Must supply a bundle");
-        }
-        if (executor == null) {
-            throw new IllegalArgumentException("Must supply an executor");
-        }
-        if (receiver == null) {
-            throw new IllegalArgumentException("Must supply a receiver");
-        }
-        if (callback == null) {
-            throw new IllegalArgumentException("Must supply a calback");
-        }
-        authenticate(mContext.getUserId(), null, cancel, bundle, executor, receiver, callback);
-    }
-
-    /**
-     * Private method, see {@link BiometricPrompt#authenticate(BiometricPrompt.CryptoObject,
-     * CancellationSignal, Executor, BiometricPrompt.AuthenticationCallback)}
-     * @param crypto
-     * @param cancel
-     * @param executor
-     * @param callback
-     * @hide
-     */
-    public void authenticate(@NonNull android.hardware.biometrics.CryptoObject crypto,
-            @NonNull CancellationSignal cancel,
-            @NonNull Bundle bundle,
-            @NonNull @CallbackExecutor Executor executor,
-            @NonNull IBiometricPromptReceiver receiver,
-            @NonNull BiometricAuthenticator.AuthenticationCallback callback) {
-        if (crypto == null) {
-            throw new IllegalArgumentException("Must supply a crypto object");
-        }
-        if (cancel == null) {
-            throw new IllegalArgumentException("Must supply a cancellation signal");
-        }
-        if (bundle == null) {
-            throw new IllegalArgumentException("Must supply a bundle");
-        }
-        if (executor == null) {
-            throw new IllegalArgumentException("Must supply an executor");
-        }
-        if (receiver == null) {
-            throw new IllegalArgumentException("Must supply a receiver");
-        }
-        if (callback == null) {
-            throw new IllegalArgumentException("Must supply a callback");
-        }
-        authenticate(mContext.getUserId(), crypto, cancel,
-                bundle, executor, receiver, callback);
-    }
-
-    /**
      * Request fingerprint enrollment. This call warms up the fingerprint hardware
      * and starts scanning for fingerprints. Progress will be indicated by callbacks to the
      * {@link EnrollmentCallback} object. It terminates when
@@ -743,6 +625,14 @@ public class FingerprintManager implements BiometricFingerprintConstants {
     }
 
     /**
+     * @hide
+     */
+    @Override
+    public boolean hasEnrolledTemplates() {
+        return hasEnrolledFingerprints();
+    }
+
+    /**
      * Determine if there is at least one fingerprint enrolled.
      *
      * @return true if at least one fingerprint is enrolled, false otherwise
@@ -785,6 +675,7 @@ public class FingerprintManager implements BiometricFingerprintConstants {
      */
     @Deprecated
     @RequiresPermission(USE_FINGERPRINT)
+    @Override
     public boolean isHardwareDetected() {
         if (mService != null) {
             try {
@@ -826,6 +717,7 @@ public class FingerprintManager implements BiometricFingerprintConstants {
      *
      * @hide
      */
+    @RequiresPermission(RESET_FINGERPRINT_LOCKOUT)
     public void resetTimeout(byte[] token) {
         if (mService != null) {
             try {
@@ -954,8 +846,8 @@ public class FingerprintManager implements BiometricFingerprintConstants {
 
     private void sendAuthenticatedSucceeded(Fingerprint fp, int userId) {
         if (mAuthenticationCallback != null) {
-            final BiometricAuthenticator.AuthenticationResult result =
-                    new BiometricAuthenticator.AuthenticationResult(mCryptoObject, fp, userId);
+            final AuthenticationResult result =
+                    new AuthenticationResult(mCryptoObject, fp, userId);
             mAuthenticationCallback.onAuthenticationSucceeded(result);
         }
     }
@@ -1042,6 +934,7 @@ public class FingerprintManager implements BiometricFingerprintConstants {
     /**
      * @hide
      */
+    @Override
     public String getErrorString(int errMsg, int vendorCode) {
         switch (errMsg) {
             case FINGERPRINT_ERROR_UNABLE_TO_PROCESS:
@@ -1127,47 +1020,23 @@ public class FingerprintManager implements BiometricFingerprintConstants {
 
         @Override // binder call
         public void onAcquired(long deviceId, int acquireInfo, int vendorCode) {
-            if (mExecutor != null) {
-                mExecutor.execute(() -> {
-                    sendAcquiredResult(deviceId, acquireInfo, vendorCode);
-                });
-            } else {
-                mHandler.obtainMessage(MSG_ACQUIRED, acquireInfo, vendorCode,
-                        deviceId).sendToTarget();
-            }
+            mHandler.obtainMessage(MSG_ACQUIRED, acquireInfo, vendorCode,
+                    deviceId).sendToTarget();
         }
 
         @Override // binder call
         public void onAuthenticationSucceeded(long deviceId, Fingerprint fp, int userId) {
-            if (mExecutor != null) {
-                mExecutor.execute(() -> {
-                    sendAuthenticatedSucceeded(fp, userId);
-                });
-            } else {
-                mHandler.obtainMessage(MSG_AUTHENTICATION_SUCCEEDED, userId, 0, fp).sendToTarget();
-            }
+            mHandler.obtainMessage(MSG_AUTHENTICATION_SUCCEEDED, userId, 0, fp).sendToTarget();
         }
 
         @Override // binder call
         public void onAuthenticationFailed(long deviceId) {
-            if (mExecutor != null) {
-                mExecutor.execute(() -> {
-                    sendAuthenticatedFailed();
-                });
-            } else {
-                mHandler.obtainMessage(MSG_AUTHENTICATION_FAILED).sendToTarget();
-            }
+            mHandler.obtainMessage(MSG_AUTHENTICATION_FAILED).sendToTarget();
         }
 
         @Override // binder call
         public void onError(long deviceId, int error, int vendorCode) {
-            if (mExecutor != null) {
-                mExecutor.execute(() -> {
-                    sendErrorResult(deviceId, error, vendorCode);
-                });
-            } else {
-                mHandler.obtainMessage(MSG_ERROR, error, vendorCode, deviceId).sendToTarget();
-            }
+            mHandler.obtainMessage(MSG_ERROR, error, vendorCode, deviceId).sendToTarget();
         }
 
         @Override // binder call
diff --git a/core/java/android/hardware/fingerprint/IFingerprintService.aidl b/core/java/android/hardware/fingerprint/IFingerprintService.aidl
index 71a642095148..2b2c0b7a098f 100644
--- a/core/java/android/hardware/fingerprint/IFingerprintService.aidl
+++ b/core/java/android/hardware/fingerprint/IFingerprintService.aidl
@@ -17,6 +17,7 @@ package android.hardware.fingerprint;
 
 import android.os.Bundle;
 import android.hardware.biometrics.IBiometricPromptReceiver;
+import android.hardware.biometrics.IBiometricPromptServiceReceiver;
 import android.hardware.biometrics.IBiometricServiceLockoutResetCallback;
 import android.hardware.fingerprint.IFingerprintClientActiveCallback;
 import android.hardware.fingerprint.IFingerprintServiceReceiver;
@@ -28,14 +29,29 @@ import java.util.List;
  * @hide
  */
 interface IFingerprintService {
-    // Authenticate the given sessionId with a fingerprint
+    // Authenticate the given sessionId with a fingerprint. This is protected by
+    // USE_FINGERPRINT/USE_BIOMETRIC permission. This is effectively deprecated, since it only comes
+    // through FingerprintManager now.
     void authenticate(IBinder token, long sessionId, int userId,
-            IFingerprintServiceReceiver receiver, int flags, String opPackageName,
-            in Bundle bundle, IBiometricPromptReceiver dialogReceiver);
+            IFingerprintServiceReceiver receiver, int flags, String opPackageName);
+
+    // This method invokes the BiometricDialog. The arguments are almost the same as above, except
+    // this is protected by the MANAGE_BIOMETRIC signature permission. This method should only be
+    // called from BiometricPromptService. The additional uid, pid, userId arguments should be
+    // determined by BiometricPromptService.
+    void authenticateFromService(IBinder token, long sessionId, int userId,
+            IBiometricPromptServiceReceiver receiver, int flags, String opPackageName,
+            in Bundle bundle, IBiometricPromptReceiver dialogReceiver,
+            int callingUid, int callingPid, int callingUserId);
 
     // Cancel authentication for the given sessionId
     void cancelAuthentication(IBinder token, String opPackageName);
 
+    // Same as above, except this is protected by the MANAGE_BIOMETRIC signature permission. Takes
+    // an additional uid, pid, userid.
+    void cancelAuthenticationFromService(IBinder token, String opPackageName,
+            int callingUid, int callingPid, int callingUserId);
+
     // Start fingerprint enrollment
     void enroll(IBinder token, in byte [] cryptoToken, int groupId, IFingerprintServiceReceiver receiver,
             int flags, String opPackageName);