Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

getCredentials fails on an unrecognized fingerprint while the biometric prompt is still open

Abierto Apto para principiantes
  • ¿Algo no está bien?
#1,095 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@pmathew92 ya está trabajando en esto.

Desde el 19/10/2026.

  • #1098 de @pmathew92 — abierto

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
72/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
android, kotlin
Área
authentication, mobile

Línea de trabajo

Empieza en auth0/src/main/java/com/auth0/android/authentication/storage/LocalAuthenticationManager.kt en onAuthenticationFailed(), que actualmente llama a resultCallback.onFailure(BIOMETRICS_INVALID_USER). Compáralo con onAuthenticationSucceeded() y onAuthenticationError(), que entregan el resultado final. Busca pruebas unitarias existentes para este gestor y ejecútalas. Se considera terminado cuando un fallo no final no informa nada y el callback recibe exactamente un resultado cuando se cierra el diálogo.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Checklist
  • The issue can be reproduced in the Auth0.Android sample app (or N/A).
  • I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
  • I have looked into the API documentation and have not found a suitable solution or answer.
  • I have searched the issues and have not found a suitable solution or answer.
  • I have searched the Auth0 Community forums and have not found a suitable solution or answer.
  • I agree to the terms within the Auth0 Code of Conduct.
Description

SecureCredentialsManager.getCredentials() with local authentication fails as soon as one fingerprint is not recognized, while the biometric prompt is still open.

LocalAuthenticationManager.onAuthenticationFailed() calls resultCallback.onFailure(CredentialsManagerException.BIOMETRICS_INVALID_USER):

https://github.com/auth0/Auth0.Android/blob/3.21.1/auth0/src/main/java/com/auth0/android/authentication/storage/LocalAuthenticationManager.kt#L79-L82

BiometricPrompt calls onAuthenticationFailed() when a biometric is read but not recognized. It is not a final result. The prompt stays open, so the user can try again or use the device credential fallback. The final result always comes later through onAuthenticationSucceeded() or onAuthenticationError().

Because of this the callback gets onFailure(BIOMETRICS_INVALID_USER) first and then, when the user does unlock, onSuccess. SecureCredentialsManager also calls updateBiometricSession() on that later success. So the session starts, but a caller that settles on the first result never sees it. That is what happens in react-native-auth0, where the first result rejects the JS promise and the later success is dropped.

Expected: onAuthenticationFailed() does not report anything, and the callback gets one result once the prompt closes.

The same applies to getApiCredentials(), which uses the same LocalAuthenticationManager.

Reproduction
  1. Configure SecureCredentialsManager with LocalAuthenticationOptions, deviceCredentialFallback = true and BiometricPolicy.Session.
  2. Call getCredentials().
  3. In the prompt, use a fingerprint that is not enrolled. With the emulator, touch the sensor with a finger that was not registered.
  4. The callback gets onFailure(BIOMETRICS_INVALID_USER) right away, while the prompt shows "Not recognized" and stays open.
  5. Tap "Use PIN" and enter the correct PIN.
  6. The callback now also gets onSuccess, and the biometric session is valid. The next getCredentials() call returns credentials without a prompt.

This happens every time on a Pixel emulator.

Additional context

Found through react-native-auth0 5.11.0, which uses Auth0.Android 3.21.0. The app shows its locked state behind the prompt that is still open, ignores the PIN the user enters, and then unlocks without a prompt on the next attempt.

The same code is in 3.21.1, 4.1.0 and 5.0.0-beta.0.

A possible fix is to remove the resultCallback.onFailure call from onAuthenticationFailed(), or to only call super.

Auth0.Android version

3.21.0 (also present in 3.21.1, 4.1.0 and 5.0.0-beta.0)

Android version(s)

Pixel emulator. The behavior follows from how BiometricPrompt reports results, so it is not specific to one Android version.

Lenguaje dominante
Kotlin
Estrellas
301
Forks
183
Merge medio
1 d 4 h
PR fusionados (30 d)
14

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de auth0/Auth0.Android

Todos los issues de auth0/Auth0.Android

Issues similares

Más issues de Kotlin

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.