Adding release and debug signature hash as valid broker host.

common/src/main/AndroidManifest.xml

@@ -34,6 +34,7 @@
     <!--https://developer.android.com/training/basics/intents/package-visibility-use-cases-->
     <queries>
         <package android:name="com.azure.authenticator" />
+        <package android:name="com.microsoft.appmanager" />
         <package android:name="com.microsoft.identity.testuserapp" />
         <package android:name="com.microsoft.windowsintune.companyportal" />
         <!-- Required for API Level 30 to make sure we can detect browsers

common/src/main/java/com/microsoft/identity/common/adal/internal/AuthenticationConstants.java

@@ -1017,6 +1017,11 @@ public static String computeMaxHostBrokerProtocol() {
          */
         public static final String COMPANY_PORTAL_APP_PACKAGE_NAME = "com.microsoft.windowsintune.companyportal";
 
+        /**
+         * LTW (Link To Windows) app package name.
+         */
+        public static final String LTW_APP_PACKAGE_NAME = "com.microsoft.appmanager";
+
         /**
          * Signature info for Intune Company portal app that installs authenticator
          * component.
@@ -1041,6 +1046,15 @@ public static String computeMaxHostBrokerProtocol() {
          */
         public static final String BROKER_HOST_APP_SIGNATURE = "1wIqXSqBj7w+h11ZifsnqwgyKrY=";
 
+        /**
+         * Signature info for LTW release
+         */
+        public static final String LTW_APP_RELEASE_SIGNATURE = "r7XE90wdLmd4th42y2Om6AWdKB0=";
+
+        /**
+         * Signature info for LTW debug
+         */
+        public static final String LTW_APP_DEBUG_SIGNATURE = "9XEEFdgYfvrXod8PFQR8QiiGSGk=";
 
         /**
          * Teams IP Phones (Sakurai devices) is supported by Intune, but does not have a back button nor browser.

common/src/main/java/com/microsoft/identity/common/adal/internal/AuthenticationSettings.java

@@ -155,8 +155,8 @@ public void setBrokerSecretKeys(final Map<String, byte[]> secretKeys) {
             throw new IllegalArgumentException("The passed in secret key map is null.");
         }
 
-        if (secretKeys.size() != 2) {
-            throw new IllegalArgumentException("Expect two keys are passed in.");
+        if (secretKeys.size() != 3) {
+            throw new IllegalArgumentException("Expect three keys are passed in.");
         }
 
         for (Map.Entry<String, byte[]> entry : secretKeys.entrySet()) {

common/src/main/java/com/microsoft/identity/common/crypto/AndroidBrokerStorageEncryptionManager.java

@@ -45,6 +45,7 @@
 import static com.microsoft.identity.common.adal.internal.AuthenticationConstants.Broker.AZURE_AUTHENTICATOR_APP_PACKAGE_NAME;
 import static com.microsoft.identity.common.adal.internal.AuthenticationConstants.Broker.BROKER_HOST_APP_PACKAGE_NAME;
 import static com.microsoft.identity.common.adal.internal.AuthenticationConstants.Broker.COMPANY_PORTAL_APP_PACKAGE_NAME;
+import static com.microsoft.identity.common.adal.internal.AuthenticationConstants.Broker.LTW_APP_PACKAGE_NAME;
 
 /**
  * Key Encryption Manager for Broker.
@@ -65,11 +66,13 @@ public class AndroidBrokerStorageEncryptionManager extends StorageEncryptionMana
 
     protected final String LEGACY_AUTHENTICATOR_APP_KEY_ALIAS = "LEGACY_AUTHENTICATOR_APP_KEY";
     protected final String LEGACY_COMPANY_PORTAL_KEY_ALIAS = "LEGACY_COMPANY_PORTAL_KEY";
+    protected final String LINK_TO_WINDOWS_KEY_ALIAS = "LINK_TO_WINDOWS_KEY";
 
     private final Context mContext;
     private final ITelemetryCallback mTelemetryCallback;
     private final PredefinedKeyLoader mLegacyAuthAppKeyLoader;
     private final PredefinedKeyLoader mLegacyCPKeyLoader;
+    private final PredefinedKeyLoader mLTWKeyLoader;
     private final AndroidWrappedKeyLoader mKeyStoreKeyLoader;
 
     public AndroidBrokerStorageEncryptionManager(@NonNull final Context context,
@@ -83,6 +86,9 @@ public AndroidBrokerStorageEncryptionManager(@NonNull final Context context,
         mLegacyCPKeyLoader = new PredefinedKeyLoader(LEGACY_COMPANY_PORTAL_KEY_ALIAS,
                 AuthenticationSettings.INSTANCE.getBrokerSecretKeys().get(COMPANY_PORTAL_APP_PACKAGE_NAME));
 
+        mLTWKeyLoader = new PredefinedKeyLoader(LINK_TO_WINDOWS_KEY_ALIAS,
+                AuthenticationSettings.INSTANCE.getBrokerSecretKeys().get(LTW_APP_PACKAGE_NAME));
+
         mKeyStoreKeyLoader = new AndroidWrappedKeyLoader(KEY_STORE_ALIAS, context, telemetryCallback);
     }
 
@@ -102,6 +108,10 @@ protected String getPackageName(){
             return mLegacyAuthAppKeyLoader;
         }
 
+        if (LTW_APP_PACKAGE_NAME.equalsIgnoreCase(packageName)) {
+            return mLTWKeyLoader;
+        }
+
         if (COMPANY_PORTAL_APP_PACKAGE_NAME.equalsIgnoreCase(packageName) ||
                 BROKER_HOST_APP_PACKAGE_NAME.equalsIgnoreCase(packageName)) {
             return mLegacyCPKeyLoader;
@@ -122,8 +132,15 @@ protected String getPackageName(){
                     BROKER_HOST_APP_PACKAGE_NAME.equalsIgnoreCase(packageName)) {
                 keyLoaders.add(mLegacyCPKeyLoader);
                 keyLoaders.add(mLegacyAuthAppKeyLoader);
+                keyLoaders.add(mLTWKeyLoader);
                 return keyLoaders;
             } else if (AZURE_AUTHENTICATOR_APP_PACKAGE_NAME.equalsIgnoreCase(packageName)) {
+                keyLoaders.add(mLegacyAuthAppKeyLoader);
+                keyLoaders.add(mLegacyCPKeyLoader);
+                keyLoaders.add(mLTWKeyLoader);
+                return keyLoaders;
+            } else if (LTW_APP_PACKAGE_NAME.equalsIgnoreCase(packageName)) {
+                keyLoaders.add(mLTWKeyLoader);
                 keyLoaders.add(mLegacyAuthAppKeyLoader);
                 keyLoaders.add(mLegacyCPKeyLoader);
                 return keyLoaders;

common/src/main/java/com/microsoft/identity/common/internal/broker/BrokerData.java

@@ -40,6 +40,9 @@
 import static com.microsoft.identity.common.adal.internal.AuthenticationConstants.Broker.BROKER_HOST_APP_SIGNATURE;
 import static com.microsoft.identity.common.adal.internal.AuthenticationConstants.Broker.COMPANY_PORTAL_APP_PACKAGE_NAME;
 import static com.microsoft.identity.common.adal.internal.AuthenticationConstants.Broker.COMPANY_PORTAL_APP_RELEASE_SIGNATURE;
+import static com.microsoft.identity.common.adal.internal.AuthenticationConstants.Broker.LTW_APP_DEBUG_SIGNATURE;
+import static com.microsoft.identity.common.adal.internal.AuthenticationConstants.Broker.LTW_APP_PACKAGE_NAME;
+import static com.microsoft.identity.common.adal.internal.AuthenticationConstants.Broker.LTW_APP_RELEASE_SIGNATURE;
 
 import lombok.ToString;
 
@@ -69,14 +72,26 @@ public class BrokerData {
             BROKER_HOST_APP_SIGNATURE
     );
 
+    public static final BrokerData LTW_DEBUG = new BrokerData(
+            LTW_APP_PACKAGE_NAME,
+            LTW_APP_DEBUG_SIGNATURE
+    );
+
+    public static final BrokerData LTW_PROD = new BrokerData(
+            LTW_APP_PACKAGE_NAME,
+            LTW_APP_RELEASE_SIGNATURE
+    );
+
     private static final Set<BrokerData> DEBUG_BROKERS = Collections.unmodifiableSet(new HashSet<BrokerData>() {{
         add(MICROSOFT_AUTHENTICATOR_DEBUG);
         add(BROKER_HOST);
+        add(LTW_DEBUG);
     }});
 
     private static final Set<BrokerData> PROD_BROKERS = Collections.unmodifiableSet(new HashSet<BrokerData>() {{
         add(MICROSOFT_AUTHENTICATOR_PROD);
         add(COMPANY_PORTAL);
+        add(LTW_PROD);
     }});
 
     private static final Set<BrokerData> ALL_BROKERS = Collections.unmodifiableSet(new HashSet<BrokerData>() {{

common/src/test/java/com/microsoft/identity/common/internal/BrokerValidatorTests.java

@@ -52,20 +52,23 @@ public void setup() {
     public void testGetValidBrokersInDebugMode() {
         BrokerValidator.setShouldTrustDebugBrokers(true);
         final Set<BrokerData> brokerData = mBrokerValidator.getValidBrokers();
-        Assert.assertEquals(4, brokerData.size());
+        Assert.assertEquals(6, brokerData.size());
         Assert.assertTrue(brokerData.contains(BrokerData.BROKER_HOST));
         Assert.assertTrue(brokerData.contains(BrokerData.COMPANY_PORTAL));
         Assert.assertTrue(brokerData.contains(BrokerData.MICROSOFT_AUTHENTICATOR_DEBUG));
         Assert.assertTrue(brokerData.contains(BrokerData.MICROSOFT_AUTHENTICATOR_PROD));
+        Assert.assertTrue(brokerData.contains(BrokerData.LTW_DEBUG));
+        Assert.assertTrue(brokerData.contains(BrokerData.LTW_PROD));
     }
 
     @Test
     public void testGetValidBrokersInReleaseMode() {
         BrokerValidator.setShouldTrustDebugBrokers(false);
         final Set<BrokerData> brokerData = mBrokerValidator.getValidBrokers();
-        Assert.assertEquals(2, brokerData.size());
+        Assert.assertEquals(3, brokerData.size());
         Assert.assertTrue(brokerData.contains(BrokerData.COMPANY_PORTAL));
         Assert.assertTrue(brokerData.contains(BrokerData.MICROSOFT_AUTHENTICATOR_PROD));
+        Assert.assertTrue(brokerData.contains(BrokerData.LTW_PROD));
     }
 
 }