1# @ohos.enterprise.accountManager (Account Management) 2 3The **accountManager** module provides APIs for account management of enterprise devices. 4 5> **NOTE** 6> 7> - The initial APIs of this module are supported since API version 12. Newly added APIs will be marked with a superscript to indicate their earliest API version. 8> 9> - The APIs of this module can be used only in the stage model. 10> 11> - The APIs of this module can be called only by a [device administrator application](../../mdm/mdm-kit-guide.md#introduction) that is enabled. 12 13## Modules to Import 14 15```ts 16import { accountManager } from '@kit.MDMKit'; 17``` 18 19## accountManager.disallowOsAccountAddition 20 21disallowOsAccountAddition(admin: Want, disallow: boolean, accountId?: number): void 22 23Users are not allowed to add accounts. 24 25**Required permissions**: ohos.permission.ENTERPRISE_SET_ACCOUNT_POLICY 26 27**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 28 29 30 31**Parameters** 32 33| Name | Type | Mandatory| Description | 34| --------- | ------------------------------------------------------- | ---- | ------------------------------------------------------------ | 35| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 36| disallow | boolean | Yes | Whether to forbid the creation of local user accounts. The value **true** means the creation of local user accounts is forbidden, and the value **false** means the opposite. | 37| accountId | number | No | User ID, which specifies a user. If this parameter is not specified, all users are not allowed to add accounts. If this parameter is specified, specified users are not allowed to add accounts. The value must be greater than or equal to 0.<br>You can call the [getOsAccountLocalId](../apis-basic-services-kit/js-apis-osAccount.md#getosaccountlocalid9) API to obtain the user ID.| 38 39**Error codes** 40 41For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 42 43| ID| Error Message | 44| -------- | ------------------------------------------------------------ | 45| 9200001 | The application is not an administrator application of the device. | 46| 9200002 | The administrator application does not have permission to manage the device. | 47| 201 | Permission verification failed. The application does not have the permission required to call the API. | 48| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 49 50**Example** 51 52```ts 53import { Want } from '@kit.AbilityKit'; 54let wantTemp: Want = { 55 bundleName: 'com.example.myapplication', 56 abilityName: 'EntryAbility', 57}; 58 59try { 60 accountManager.disallowOsAccountAddition(wantTemp, true, 100); 61 console.info('Succeeded in disallowing os account addition.'); 62} catch (err) { 63 console.error(`Failed to disallow os account addition. Code: ${err.code}, message: ${err.message}`); 64} 65``` 66 67## accountManager.isOsAccountAdditionDisallowed 68 69isOsAccountAdditionDisallowed(admin: Want, accountId?: number): boolean 70 71Queries whether a user is not allowed to add an account. 72 73**Required permissions**: ohos.permission.ENTERPRISE_SET_ACCOUNT_POLICY 74 75**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 76 77 78 79**Parameters** 80 81| Name | Type | Mandatory| Description | 82| --------- | ------------------------------------------------------- | ---- | ------------------------------------------------------------ | 83| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 84| accountId | number | No | User ID, which specifies a user. If this parameter is not specified, the system queries whether all users are not allowed to add accounts. If this parameter is specified, the system queries whether specified users are not allowed to add accounts. The value must be greater than or equal to 0.<br>You can call the [getOsAccountLocalId](../apis-basic-services-kit/js-apis-osAccount.md#getosaccountlocalid9) API to obtain the user ID.| 85 86**Return value** 87 88| Type | Description | 89| ------- | ---------------------------------------------------------- | 90| boolean | If **true** is returned, accounts cannot be added.<br>If **false** is returned, the account can be added.| 91 92**Error codes** 93 94For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 95 96| ID| Error Message | 97| -------- | ------------------------------------------------------------ | 98| 9200001 | The application is not an administrator application of the device. | 99| 9200002 | The administrator application does not have permission to manage the device. | 100| 201 | Permission verification failed. The application does not have the permission required to call the API. | 101| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 102 103**Example** 104 105```ts 106import { Want } from '@kit.AbilityKit'; 107let wantTemp: Want = { 108 bundleName: 'com.example.myapplication', 109 abilityName: 'EntryAbility', 110}; 111 112try { 113 let isDisallowed: boolean = accountManager.isOsAccountAdditionDisallowed(wantTemp, 100); 114 console.info(`Succeeded in querying the os account addition or not: ${isDisallowed}`); 115} catch (err) { 116 console.error(`Failed to query the os account addition or not. Code: ${err.code}, message: ${err.message}`); 117} 118``` 119 120## accountManager.addOsAccountAsync 121 122addOsAccountAsync(admin: Want, name: string, type: osAccount.OsAccountType): Promise<osAccount.OsAccountInfo> 123 124Adds an account in the background. This API uses a promise to return the result. 125 126**Required permissions**: ohos.permission.ENTERPRISE_SET_ACCOUNT_POLICY 127 128**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 129 130 131 132**Parameters** 133 134| Name| Type | Mandatory| Description | 135| ------ | ------------------------------------------------------------ | ---- | ------------------------------------------------------------ | 136| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 137| name | string | Yes | Account name, which is the name of the account to be added. An account with the same name or an empty name cannot be created.| 138| type | [osAccount.OsAccountType](../apis-basic-services-kit/js-apis-osAccount.md#osaccounttype) | Yes | Type of the account to add.<br>The value can be any of the following:<br>· **ADMIN**: administrator account.<br>· **NORMAL**: normal account.<br>· **GUEST**: guest account.| 139 140**Return value** 141 142| Type | Description | 143| ------------------------------------------------------------ | -------------------- | 144| [osAccount.OsAccountInfo](../apis-basic-services-kit/js-apis-osAccount.md#osaccounttype) | Information about the account added.| 145 146**Error codes** 147 148For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 149 150| ID| Error Message | 151| -------- | ------------------------------------------------------------ | 152| 9200001 | The application is not an administrator application of the device. | 153| 9200002 | The administrator application does not have permission to manage the device. | 154| 9201003 | Failed to add an OS account. | 155| 201 | Permission verification failed. The application does not have the permission required to call the API. | 156| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 157 158**Example** 159 160```ts 161import { Want } from '@kit.AbilityKit'; 162import { BusinessError, osAccount } from '@kit.BasicServicesKit'; 163let wantTemp: Want = { 164 bundleName: 'com.example.myapplication', 165 abilityName: 'EntryAbility', 166}; 167 168accountManager.addOsAccountAsync(wantTemp, "TestAccountName", osAccount.OsAccountType.NORMAL).then((info) => { 169 console.info(`Succeeded in creating os account: ${JSON.stringify(info)}`); 170}).catch((err: BusinessError) => { 171 console.error(`Failed to creating os account. Code: ${err.code}, message: ${err.message}`); 172}); 173``` 174## accountManager.setDomainAccountPolicy<sup>18+</sup> 175 176setDomainAccountPolicy(admin: Want, domainAccountInfo: osAccount.DomainAccountInfo, policy: DomainAccountPolicy): void 177 178Sets the domain account policy. This API takes effect only on 2-in-1 devices. 179 180**Required permissions**: ohos.permission.ENTERPRISE_SET_ACCOUNT_POLICY 181 182**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 183 184**Parameters** 185 186| Name | Type | Mandatory| Description | 187| ----------------- | ------------------------------------------------------------ | ---- | ------------------------------------------------------------ | 188| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 189| domainAccountInfo | [osAccount.DomainAccountInfo](../apis-basic-services-kit/js-apis-osAccount.md#domainaccountinfo8) | Yes | Domain account information.<br>If the internal attribute of **domainAccountInfo** is empty, a global policy is set for all domain accounts.<br>If the internal attribute of **domainAccountInfo** is not empty, the policy is set for the specified domain account.<br>The priority of the specified domain account policy is higher than that of the global policy. If the specified domain account has a domain account policy, the global policy does not take effect for the domain account.<br>Note: To set a policy for a specified domain account, the **serverConfigId** field in **DomainAccountInfo** is mandatory.| 190| policy | [DomainAccountPolicy](#domainaccountpolicy18) | Yes | Domain account policy.<br>Note: After setting the domain account policy, you must change the domain account password on the device. Otherwise, the **passwordValidityPeriod** and **passwordExpirationNotification** configurations in **DomainAccountPolicy** do not take effect.| 191 192**Error codes** 193 194For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 195 196| ID| Error Message | 197| -------- | ------------------------------------------------------------ | 198| 9200001 | The application is not an administrator application of the device. | 199| 9200002 | The administrator application does not have permission to manage the device. | 200| 201 | Permission verification failed. The application does not have the permission required to call the API. | 201| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 202 203**Example** 204 205```ts 206import { Want } from '@kit.AbilityKit'; 207import { BusinessError, osAccount } from '@kit.BasicServicesKit'; 208let wantTemp: Want = { 209 bundleName: 'com.example.myapplication', 210 abilityName: 'EntryAbility', 211}; 212let policy: accountManager.DomainAccountPolicy = { 213 authenticationValidityPeriod: 300, 214 passwordValidityPeriod: 420, 215 passwordExpirationNotification: 60, 216} 217// Set the global domain account policy. 218let accountInfo: osAccount.DomainAccountInfo = { 219 domain: '', 220 accountName: '', 221 serverConfigId: '', 222} 223try { 224 accountManager.setDomainAccountPolicy(wantTemp, accountInfo, policy); 225 console.info('Succeeded in setting global domainAccount policy.'); 226} catch (err) { 227 console.error(`Failed to set domainAccount policy. Code: ${err.code}, message: ${err.message}`); 228} 229// Set the policy for a specified domain account. 230let accountInfo2: osAccount.DomainAccountInfo = { 231 domain: '', 232 accountName: '', 233 serverConfigId: '', 234} 235let userId: number = 100; 236await osAccount.getAccountManager().getOsAccountDomainInfo(userId).then((domainAccountInfo: osAccount.DomainAccountInfo) => { 237 accountInfo2 = domainAccountInfo; 238}).catch((err: BusinessError) => { 239 console.error(`Failed to get account domain info. Code: ${err.code}, message: ${err.message}`); 240}) 241try { 242 accountManager.setDomainAccountPolicy(wantTemp, accountInfo2, policy); 243 console.info('Succeeded in setting domain account policy.'); 244} catch (err) { 245 console.error(`Failed to set domain account policy. Code: ${err.code}, message: ${err.message}`); 246} 247``` 248 249 250 251## accountManager.getDomainAccountPolicy<sup>18+</sup> 252 253getDomainAccountPolicy(admin: Want, domainAccountInfo: osAccount.DomainAccountInfo): DomainAccountPolicy 254 255Obtains the domain account policy. This API takes effect only on 2-in-1 devices. 256 257**Required permissions**: ohos.permission.ENTERPRISE_SET_ACCOUNT_POLICY 258 259**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 260 261**Parameters** 262 263| Name | Type | Mandatory| Description | 264| ----------------- | ------------------------------------------------------------ | ---- | ------------------------------------------------------------ | 265| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 266| domainAccountInfo | [osAccount.DomainAccountInfo](../apis-basic-services-kit/js-apis-osAccount.md#domainaccountinfo8) | Yes | Domain account information.<br>If all the internal attributes of **domainAccountInfo** are empty, the global domain account policy is queried.<br>If the internal attribute of **domainAccountInfo** is not empty, the specified domain account policy is queried.<br>Note: To query a specified domain account policy, the **serverConfigId** field in **DomainAccountInfo** is mandatory.| 267 268**Return value** 269 270| Type | Description | 271| ------------------------------------------------------------ | -------------------- | 272| [DomainAccountPolicy](#domainaccountpolicy18) | Domain account policy.| 273 274**Error codes** 275 276For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 277 278| ID| Error Message | 279| -------- | ------------------------------------------------------------ | 280| 9200001 | The application is not an administrator application of the device. | 281| 9200002 | The administrator application does not have permission to manage the device. | 282| 201 | Permission verification failed. The application does not have the permission required to call the API. | 283| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 284 285**Example** 286 287```ts 288import { Want } from '@kit.AbilityKit'; 289import { BusinessError, osAccount } from '@kit.BasicServicesKit'; 290let wantTemp: Want = { 291 bundleName: 'com.example.myapplication', 292 abilityName: 'EntryAbility', 293}; 294let domainAccountPolicy: accountManager.DomainAccountPolicy = {} 295// Query the global domain account policy. 296let accountInfo: osAccount.DomainAccountInfo = { 297 domain: '', 298 accountName: '', 299 serverConfigId: '', 300} 301try { 302 domainAccountPolicy = accountManager.getDomainAccountPolicy(wantTemp, accountInfo); 303 console.info('Succeeded in getting global domain account policy.'); 304} catch (err) { 305 console.error(`Failed to get domain account policy. Code: ${err.code}, message: ${err.message}`); 306} 307// Query the policy of a specified domain account. 308let accountInfo2: osAccount.DomainAccountInfo = { 309 domain: '', 310 accountName: '', 311 serverConfigId: '', 312} 313let userId: number = 100; 314await osAccount.getAccountManager().getOsAccountDomainInfo(userId).then((domainAccountInfo: osAccount.DomainAccountInfo) => { 315 accountInfo2 = domainAccountInfo; 316}).catch((err: BusinessError) => { 317 console.error(`Failed to get account domain info. Code: ${err.code}, message: ${err.message}`); 318}) 319try { 320 domainAccountPolicy = accountManager.getDomainAccountPolicy(wantTemp, accountInfo2); 321 console.info('Succeeded in getting domain account policy.'); 322} catch (err) { 323 console.error(`Failed to get domain account policy. Code: ${err.code}, message: ${err.message}`); 324} 325``` 326 327## DomainAccountPolicy<sup>18+</sup> 328 329Domain account policy. 330 331**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 332 333| Name | Type | Mandatory| Description | 334| ------------------------------ | ------ | ---- | ------------------------------------------------------------ | 335| authenticationValidityPeriod | number | No | Validity period of the domain account authentication token, in seconds. The value range is [-1, 2147483647]. The validity period starts from the time when the domain account is authenticated for the last time, for example, login or unlocking after the screen is locked.<br>The default value is **-1**, indicating that the token is permanently valid. The value **0** indicates that the token becomes invalid immediately. After the token expires or becomes invalid, the domain account and password must be authenticated when a user logs in to the system.| 336| passwordValidityPeriod | number | No | Validity period of the domain account password, in seconds. The value range is [-1,2147483647]. The validity period starts from the time when the password is last changed on the device.<br>The default value is **-1**, indicating that the domain account password is permanently valid.| 337| passwordExpirationNotification | number | No | Notification period before a domain account password expires, in seconds. The value range is [0, 2147483647].<br>The default value is **0**, indicating that the system does not display a message indicating that the domain account password has expired.<br>Note: **passwordExpirationNotification** must be used together with **passwordValidityPeriod**. When the system time is later than or equal to (the time when the domain account password is last changed on the device + the value of **passwordValidityPeriod** – the value of **passwordExpirationNotification**), a message is displayed, indicating that the password is about to expire.| 338