Applying changes to support Binding with fallback when the biometrics…#147
Merged
george-bafaloukas-forgerock merged 2 commits intodevelopfrom Apr 24, 2026
Merged
Conversation
… are not set on the device. Adding more tests and code comments explaining the functionality
george-bafaloukas-forgerock
requested review from
rodrigoareis,
vahancouver and
witrisna
witrisna
approved these changes
Apr 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Applying changes to support Binding with fallback when the biometrics are not set on the device. Adding more tests and code comments explaining the functionality
JIRA Ticket
JIRA "[iOS][Unified]Investigate DeviceBinding BiometricWithFallback not working when Passcode is set and Biometrics is disabled"
Description
Biometric & Passcode Logic Improvements
Dynamic Access Control: In BiometricDeviceCredentialAuthenticator, the code now checks if biometrics are available before creating keys.
If biometrics are enrolled: Uses [.biometryAny, .or, .devicePasscode].
If no biometrics: Uses only .devicePasscode.
Fix for Creation Failures: By switching from .biometryCurrentSet to .biometryAny, the SDK prevents the Secure Enclave from rejecting key creation on devices where biometrics aren't configured yet.
2. Security & State Tracking
Biometric Domain State: Added biometricDomainState (of type Data?) to the UserKey model. This captures a "snapshot" of the device's biometric enrollment at the time of binding.
Tamper Detection: During the sign operation, the authenticator compares the current biometric state with the stored state. If they differ (e.g., a new fingerprint was added), the key is deleted and the user is forced to re-bind for security.
Backward Compatibility: The UserKey initializer now defaults the state to nil, ensuring existing keys created on older versions of the SDK continue to work without triggering the state check.
3. Project & Housekeeping
New Tests: Added BiometricDeviceCredentialAuthenticatorTests.swift to the project and build phases.
Documentation: Significantly improved the header documentation in the authenticator class to explain the security model and hardware-vs-software invalidation.
Checklist: