getCredentials fails on an unrecognized fingerprint while the biometric prompt is still open

auth0/src/main/java/com/auth0/android/authentication/storage/LocalAuthenticationManager.kt の onAuthenticationFailed() から始めてください。このメソッドは現在 resultCallback.onFailure(BIOMETRICS_INVALID_USER) を呼び出しています。onAuthenticationSucceeded() および onAuthenticationError() と比較してください。これらは最終結果を返します。このマネージャーの既存のユニットテストを探して実行してください。完了の条件は、最終ではない失敗では何も報告されず、プロンプトが閉じられたときにコールバックがちょうど1つの結果を受け取ることです。

Checklist

• The issue can be reproduced in the Auth0.Android sample app (or N/A).
• I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

SecureCredentialsManager.getCredentials() with local authentication fails as soon as one fingerprint is not recognized, while the biometric prompt is still open.

LocalAuthenticationManager.onAuthenticationFailed() calls resultCallback.onFailure(CredentialsManagerException.BIOMETRICS_INVALID_USER):

https://github.com/auth0/Auth0.Android/blob/3.21.1/auth0/src/main/java/com/auth0/android/authentication/storage/LocalAuthenticationManager.kt#L79-L82

BiometricPrompt calls onAuthenticationFailed() when a biometric is read but not recognized. It is not a final result. The prompt stays open, so the user can try again or use the device credential fallback. The final result always comes later through onAuthenticationSucceeded() or onAuthenticationError().

Because of this the callback gets onFailure(BIOMETRICS_INVALID_USER) first and then, when the user does unlock, onSuccess. SecureCredentialsManager also calls updateBiometricSession() on that later success. So the session starts, but a caller that settles on the first result never sees it. That is what happens in react-native-auth0, where the first result rejects the JS promise and the later success is dropped.

Expected: onAuthenticationFailed() does not report anything, and the callback gets one result once the prompt closes.

The same applies to getApiCredentials(), which uses the same LocalAuthenticationManager.

Reproduction

1. Configure SecureCredentialsManager with LocalAuthenticationOptions, deviceCredentialFallback = true and BiometricPolicy.Session.
2. Call getCredentials().
3. In the prompt, use a fingerprint that is not enrolled. With the emulator, touch the sensor with a finger that was not registered.
4. The callback gets onFailure(BIOMETRICS_INVALID_USER) right away, while the prompt shows "Not recognized" and stays open.
5. Tap "Use PIN" and enter the correct PIN.
6. The callback now also gets onSuccess, and the biometric session is valid. The next getCredentials() call returns credentials without a prompt.

This happens every time on a Pixel emulator.

Additional context

Found through react-native-auth0 5.11.0, which uses Auth0.Android 3.21.0. The app shows its locked state behind the prompt that is still open, ignores the PIN the user enters, and then unlocks without a prompt on the next attempt.

The same code is in 3.21.1, 4.1.0 and 5.0.0-beta.0.

A possible fix is to remove the resultCallback.onFailure call from onAuthenticationFailed(), or to only call super.

Auth0.Android version

3.21.0 (also present in 3.21.1, 4.1.0 and 5.0.0-beta.0)

Android version(s)

Pixel emulator. The behavior follows from how BiometricPrompt reports results, so it is not specific to one Android version.