binding/com.pingidentity.device.binding.authenticator/BiometricOnlyAuthenticator

BiometricOnlyAuthenticator

open class BiometricOnlyAuthenticator(config: BiometricAuthenticatorConfig) : BiometricAuthenticator

Pure biometric authenticator that requires biometric authentication without fallback options.

This authenticator provides the highest level of biometric security by requiring exclusive biometric authentication (fingerprint, face recognition, iris scanning) without allowing fallback to device credentials. It automatically adapts between strong and weak biometric authentication based on device capabilities while maintaining strict biometric-only access.

Limitations:

No fallback authentication if biometric fails or is unavailable
Users may be locked out if biometric sensors malfunction
Not suitable for users who cannot use biometric authentication
Requires user education about biometric-only access limitations

Example usage:

val authenticator = BiometricOnlyAuthenticator {
    strongBoxPreferred = true

    promptInfo {
        setTitle("Biometric Authentication Required")
        setSubtitle("Use your fingerprint or face")
        setDescription("Access requires biometric verification only")
        setNegativeButtonText("Cancel")
        setConfirmationRequired(false) // Faster authentication
    }

    keyGenParameterSpec {
        setUserAuthenticationRequired(true)
        setUserAuthenticationValidityDurationSeconds(0) // Always require biometric
        setInvalidatedByBiometricEnrollment(true)
        setIsStrongBoxBacked(true)
    }
}

// Register with biometric-only protection
val registrationResult = authenticator.register(context, Attestation.Default(challenge))

// Authenticate using biometric only
val authResult = authenticator.authenticate(context)
if (authResult.isSuccess) {
    val (privateKey, cryptoObject) = authResult.getOrNull()!!
    // cryptoObject available when using BIOMETRIC_STRONG
}