Getting started with Android Fingerprint Authentication

With the release of Android 6.0 Marshmallow, Google has introduced best way to authenticate the User- That is Fingerprint Authentication.With this API, Google has created a native approach for fingerprint authentication across all Android devices. Developers can now authenticate their users on an app-by-app basis for everything from mobile purchases to app sign-in screens and more with just the tap of a finger.

Why fingerprint authentication?

let’s look at some of the ways in which fingerprint authentication can improve the user experience:

• It’s a quick and convenient way of authenticating the user’s identity.
• You can’t forget a fingerprint!
• No more struggling with mobile keyboards.
• No more annoying password recovery or reset.
• our fingerprint is unique and impossible to guess.

Creating the Fingerprint Authentication Project

Imagine you are developing an app that requires to perform some critical operation like, payment. You want to be sure that your user is authenticated prior wiring any kind of money, right?

Let’s go through a sample application that authenticate the user by fingerprint.

Complete source code for the examples used in this tutorial is available on github.

Creating New Project

Open Android Studio and create a new project. You can use the settings of your choice, but set your project’s SDK version to Android 6.0 (API 23) or higher.

Updating the Manifest

Fingerprint authentication requires that the app request the USE_FINGERPRINT permission within the project manifest file.

Creating user interface

Create the fingerprint icon with the help of “Android Image Assets”. To do so, Right click on the drawable folder and Create a New ⇒ Image Asset named ic_action_fingerprint.

You can download fingerprint icons from here and paste in res folder.

Now we have all our resources, let’s create our UI:

Checking the Security Settings

Now time to implement the fingerprint authentication part of our app.As a first step we’re going to check that:

• The device features a fingerprint sensor.
• The user has protected their lockscreen.
• The user has registered at least one fingerprint on their device.

Create a method called checkFingerPrintSensor() on MainAcitivity.java file.

Accessing Android Keystore and Generate Encryption Key

We are going to create a method called generateKey() that generate an encryption key which is then stored securely on the device using the Android Keystore system.

The following task are going to do:

• Gain access to the Android keystore, by generating a Keystore instance.
• Initialize the KeyGenerator by Specify the operation(s) this key can be used for
• Configure this key so that the user has to confirm their identity with a fingerprint each time they want to use it
• Generate the key

Create the Android Cipher

The cipher that will be used to create the encrypted FingerprintManager.CryptoObject instance. This CryptoObject will, in turn, be used during the fingerprint authentication process.

The getInstance method of the Cipher class is called to obtain a Cipher instance which is subsequently configured with the properties required for fingerprint authentication. The previously generated key is then extracted from the Keystore container and used to initialize the Cipher instance.

Create method with name generateCipher() that return a cipher object.

Authenticating

We’re ready to authenticate.This is done by calling FingerprintManager’s authenticate(CryptoObject, CancellationSignal, int, AuthenticationCallback, Handler) method.

CryptoObject

The crypto object is passed to fingerprint manager to protect the integrity of the fingerprint authentication.There is a chance that third party can intercept the results returned by fingerprint scanner. Crypto object is used to encrypt the results returned by fingerprint scanner.

CancellationSignal

This gives us the ability to stop listening for fingerprints. In a typical implementation, this class's cancel() method will be called in the onPause() lifecycle method. This ensures we aren’t listening for fingerprints while the application isn’t available.

AuthenticationCallback

This is the listener for fingerprint events. Create an AuthenticationCallback object like below:

Finally the onCreate() method will look like this:

Updating user interface

Next step is to update the user interface with authentication success or failure.Just create two method to handle this.

Testing the project

Whenever you’re working on an Android app, you should test that app across a wide range of Android Virtual Devices (AVDs) plus at least one physical Android smartphone or tablet.

First, make sure your Android smartphone or tablet is configured to support fingerprint authentication by securing your lockscreen with a PIN, password or pattern and then registering at least one fingerprint on your device. Typically, you register a fingerprint by going to  Settings ⇒ Security ⇒ Fingerprint and then following the onscreen instructions.

When it comes to testing Android’s fingerprint authentication on an AVD, there’s an immediate problem: an emulated Android device doesn’t have any physical hardware.The solution is to use the extended controls of the AVD.