You could use a central app that does the sign-on, and call it as a service from the other apps. The sign-on management app should have a service marked with an application-specific permission (see https://developer.android.com/guide/topics/manifest/permission-element.html), and should set the android:protectionLevel
attribute to signature
; for example in your android manifest:
<permission android:name="com.example.SSO_ACCESS"
android:protectionLevel="signature" />
And also in your Android manifest:
<service android:enabled="true"
android:exported="true"
android:name=".SingleSignOnService"
android:permission="com.example.SSO_ACCESS" >
. . .
</service>
This will allow apps you create to communicate with the sign-on app's service, but no other applications will be able to.
You should communicate with the service using standard Android service techniques (bind to the service using bindService()
with an appropriate intent - you will need an appropriate intent filter for the service in the manifest) - see the Android services guide for information on this.