Develop Reference

Android - best practices for authorization

I am researching how to autenticate and authorize user within Android application
For autentication there is the AccountManager but I am not sure how to check whether the user is signed in or not. I know how to set up AccountAuthenticatorActivity and AuthenticatorService but I am not sure how its connected with the application.
Am I supposed to call some check on every onCreate in every activity to ensure that the user is signed in or does the service does that for me somehow?
If I am supposed to do some regular checking, what is the best practice towards where such checking should be called?

It depends on your application, really. Unless you have a requirement for very strict security, like a financial application, government application, etc. I think you could get by with a simpler approach. For example, after a user logs in (however you choose to implement this) store a value in SharedPreferences to denote the user has authenticated. From here, you could do one of the following:
If your application requires you authenticate every activity/fragment you launch, simply check this SharedPreferences value. You could also create a base activity that all your other activities extend and do your authentication check there.
If you only need to authenticate once, modify your launcher activity in your manifest to check for this value. If the user has authenticated already, create a new Intent for your 'home' activity and redirect your user and finish() the launcher activity.

As always, it depends. Do you need to protect the whole app? or some particular activities or some fragment in some activities. Take a look at Mint app.
It asks the user to enter pass code to access app. For something like this, create a base activity and make all activities in your app inherit this and do the checking in the base activity.
If you need to secure just some activities, create a base activity
just for these activities and do your security check there.
If it is for some portion of an activity, You have to roll up something specific for your workflow.
Just a tip, Try to split your question into smaller problems, it makes easier for people to answer.

Making a set up screen on first start up

I'm here today asking someone if they know a way to make a set up screen on first start up.
Here's the scenario: When someone downloads my app and uses it for the first time, it has to show a method where users make a password. On subsequent uses, I don't want it to be shown anymore. Does anybody know how to do this?

You can use the SharedPreferences for this purpose.
At the start of your application, check if the key "myKey+versioncode" is present or not in the SharedPreferences. If it not stored, then it means your application has not bee started yet, let the user create his/her password. Once the password is created, add the SharedPreferences "myKey+versioncode" with any value you like, and next time you will find this SharedPreferences, so it means the user already started the application and created its password.
However be careful about the "versionning" of this key, you might also want to keep a single key instead of one per version of your application.
Edit: Concept found at the time I was looking for EULA inplementation, here: Simple EULA implementation for Android

Is it possible to show screen only once when app starts up?

I want to be able to prompt the users to enter the details required for the app only when it starts up for the first time (not other times). These details will be held in a database on the phone.
Would it be better to check the database each time or put these details in a shared preference? Furthermore, is this type of activity even possible on Android?

Depends on the details really. If it is a large amount of information you might consider using a Database. For just basic identification information, SharedPreferences should be fine.
If you do use a Database, you might consider loading them into your Application object. This would depend on how frequently you use this information in your app.
To check for the first start of the app, a SharedPreference is generally used AFAIK.

Use SharedPreferences or Database depending on the data complexity and its need later on..
Store a Flag in SharedPreferences and set this when user enters the data.
Check that shared preferences flag while on your first activity and redirects accordingly(to Details/one time page) if required.
here even if a user manually deletes data using Settings > Manage app > your app > clear data, Your app will know to get the details then from user....

How to know if Android app is redeployed ?

I'm building an SDK and I have class called e.g mainClass, so in the app MainActivity I let the developers(that uses the SDK) pass data like the app key in the mainClass constructor and then they call register function that will start registration service only the first time the app was open (using preference).
The problem is when a developer changes the app key and deploys the app again (with the new app key) the preference of the app (appFirstOpen=false) stays there and registering the new app key will not go through.
I thought about checking if app key changed in the constructor but it seems like an overhead. is there away to know if the app is redployed to clear the preference or is there anyother way to get pass this issue.

To answer the question in the title, no there isn't a new deployment flag. So you will have to check other factors such as app id, in your application, or the PackageInfo or ApplicationInfo from the system. If you just wanted to wipe the data of the application you can manually clear data in Settings -> Applications, or just wipe the Preference data every time with SharedPreferences.Editor.clear().
It appears that you're having an issue when the same application run against a new app id. This would suggest to me that working with the overhead of checking the app id would be worth doing. I would suggest have one preference file per app id it will be able to handle appFirstOpen conditions.

secure from unauthorised access

Based on the user requirements, he wants to use our android application via pin code access like login whenever he starts to use this application. In Android or any mobile, most of the applications start again the last using layout. so which event should i call this login alertdialog to access each time users start to use it? Or let me know the better. Thank you.

You will have to add a snippet of code in each Activity you have so that it ask the user to type the user & password. If you are using normal activities I guess you can add the snippet inside methods like onRestoreInstanceState so that you can be sure it will be executed as soon as the user (re)open the activity.