How to check what biometrics are supported on API level 28+?

Question

I want to check what biometrics are supported on Android devices with API level 28+ to be able to to show relevant text to the users. E.g. "Log in with Fingerprint", "Login with Face", "Login with Iris", "Enable Fingerprint login", "Enable Face login", etc.

I am using BiometricManager.canAuthenticate() to determine if biometrics can be used. For versions older than 28 BiometricManager uses FingerprintManagerCompat internally so I know that if the result is BIOMETRIC_SUCCESS the device uses fingerprint.

Is there a way to know what biometrics are supported - fingerprint, face, iris? Maybe some devices can support more than one.

Answer 1

Only devices with API29 provide more biometric options than fingerprint.

By checking the android.hardware.biometrics.BiometricManager.hasBiometrics() (API29) you can understand how to inspect what biometrics are available:

final PackageManager pm = context.getPackageManager();
        return pm.hasSystemFeature(PackageManager.FEATURE_FINGERPRINT)
                || pm.hasSystemFeature(PackageManager.FEATURE_IRIS)
                || pm.hasSystemFeature(PackageManager.FEATURE_FACE);

Answer 2

It seems that it is not possible to find out the actual biometric method being used on Android (unlike on iOS). But it is possible to detect supported biometric methods on Android 10:

PackageManager pm = context.getPackageManager();
boolean hasFingerprint = pm.hasSystemFeature(PackageManager.FEATURE_FINGERPRINT);
boolean hasFace = pm.hasSystemFeature(PackageManager.FEATURE_FACE);
boolean hasIris = pm.hasSystemFeature(PackageManager.FEATURE_IRIS);

Therefore if the phone supports only face feature you can use "Login with Face" in the GUI. If it supports only fingerprint feature you can use "Login with Fingerprint", etc.

If it supports multiple biometric methods you will have to use some generic text like "Biometric login".

Answer 3

The BiometricManager API seems to be designed so that the calling app must be agnostic to the authentication method used. So that it does not make a difference how user authenticates as long as he succeeds (along with this come requirements for strong authentication on the vendor side https://source.android.com/security/biometric).

As a result, the bad thing: you cannot have a title matching the authentication method, so you should come up with something generic like "Please authorize the operation". The good news is that the dialog prompt is already presenting by in accordance with supported authentication method (e.g. for fingerprint authentication the UI presents text "Touch the fingerprint sensor" along the matching icon). This is done by the platform and cannot be controlled by the calling app.

Partial solution: You can check specifically about the availability of fingerprint authentication by using the (now deprecated) API https://developer.android.com/reference/android/hardware/fingerprint/FingerprintManager

Answer 4

The official recommendation is that you use the AndroidX Biometric Library. It comes with a standard UI that handles form-factors for you. Essentially it detects whether a device has fingerprint or face authentication form factor and handles it: as a developer you do not need to create a biometrics authentication UI. To check whether a device supports biometrics at all, you would do

override fun onClick(view: View) {  // user clicks to authenticate
   val promptInfo = createPromptInfo()
   if (BiometricManager.from(context)
               .canAuthenticate() == BiometricManager.BIOMETRIC_SUCCESS) {
       biometricPrompt.authenticate(promptInfo, cryptoObject)
   } else {
       loginWithAppAccountPassword()
   }
}

Reasons you should use the Biometric Support Library:

• Developers no longer need to anticipate different API levels in their code because the library handles all API matching under the hood. For instance, the support library seamlessly uses FingerprintManager on API levels 23 to 27 and BiometricPrompt on API level 28 and above.
• Developers no longer need to create their own authentication UI. The library provides a standard and familiar UI that matches a user’s biometric authentication form factor, such as fingerprint or face authentication.
• Developers can check if a device supports biometric authentication with a single method call.

Answer 5

Using PackageManager allows to check which biometrics are supported. Here is an article proposing how to deal with showing strings which are understandable for the user.