SecurityException on addAccountExplicitly after app update — AuthenticatorService not yet registered

[caff-uk]

Description

After an app update, UserAccountManager.createAccount() crashes with a SecurityException on accountManager.addAccountExplicitly() because the Android OS has not yet re-registered the app's AuthenticatorService.

This is a race condition between the app launching after an update and the OS recognizing the updated authenticator. It occurs sporadically in production — we see it in Crashlytics on multiple devices.

Stack Trace

java.lang.SecurityException: caller uid XXXXX is different than the authenticator's uid
    at android.os.Parcel.createExceptionOrNull(Parcel.java:3057)
    at android.os.Parcel.createException(Parcel.java:3041)
    at android.accounts.AccountManager.addAccountExplicitly(AccountManager.java:892)
    at com.salesforce.androidsdk.accounts.UserAccountManager.createAccount(UserAccountManager.java:446)

Root Cause

In UserAccountManager.createAccount(), accountManager.addAccountExplicitly() is called once with no error handling for SecurityException. After an app update, Android may not have re-registered the authenticator yet, causing a UID mismatch.

Expected Behavior

addAccountExplicitly() should retry with a short backoff to allow the OS to register the authenticator:

SecurityException lastException = null;
int maxRetries = 3;
for (int attempt = 0; attempt < maxRetries; attempt++) {
    try {
        success = accountManager.addAccountExplicitly(acc, password, new Bundle());
        break;
    } catch (SecurityException e) {
        lastException = e;
        if (attempt < maxRetries - 1 && Looper.myLooper() != Looper.getMainLooper()) {
            Thread.sleep(500);
        }
    }
}
if (lastException != null) throw lastException;

Affected Versions

• Confirmed on 13.2.0 and 13.2.1
• Likely affects all versions using Android AccountManager

Environment

• Android SDK 13.2.0/13.2.1
• Various Android versions (seen on Android 13, 14, 15)
• Occurs after app updates via Play Store or side-loading

[wmathurin]

Thank you for the report and the stack trace, @caff-uk! We've confirmed both addAccountExplicitly call sites are unguarded. This is a real race condition after app updates and we've logged a bug to wrap both call sites with proper exception handling and retry logic. Fix will be in an upcoming release.

[caff-uk]

thanks @wmathurin !