Authenticator should support Biometric authentication

[pmellaaho]

Before opening, please confirm:

• I have searched for duplicate or closed issues.

Which UI component is this feature-request for?

Authenticator

Please include any relevant guides or documentation you're referencing

No response

Please describe your feature-request in detail.

Currently the Authenticator supports the sign-in with username and password. There are many reasons why modern applications would like to move on to passwordless sign-in but one of main pain points is the usability and things like Password managers are too cumbersome for most users to use. The Authenticator could complement the sign-in experience by offering the possibility to activate and use biometrics (e.g. fingerprint) to access username and password safely (encrypted) stored in device with the help of Android KeyStore. So, the user would be given an option to type in username and password in every sign-in or activate biometric login to get easier sign-in experience. In the of biometric login prompt the fall back option to use app credentials would still be offered.

Initialization steps (if applicable)

No response

Code Snippet

// Put your code below this line.

amplifyconfiguration.json

No response

Additional information and screenshots

No response

[tylerjroach]

Thank you for the feature request. Will leave this ticket open to allow others to provide +1 reactions or additional comments.

[mattcreaser]

Amplify is adding support for WebAuthn passkeys in this PR: aws-amplify/amplify-android#2952. We will be building on this to offer the option of biometric login in the near future.

[pmellaaho]

Good to hear, I think this is great news!
How it's going to work for existing users, are they gonna be able to switch to passkey with/without a new Sign-up?

[mattcreaser]

Hey @pmellaaho. Existing users are able to register their device as a passkey once webauthn is enabled for the user pool. Whether Authenticator itself will prompt the user for this or defer to the application to call into Amplify is TBD.

Sign-up with passkeys is not supported - users need to sign up either with a password or via an OTP sms or email code first, and then register the passkey after acccount creation.

You can check out the Cognito documentation for a lot more information about how Passkeys work.

[mattcreaser]

Just an update here, we are working on adding passwordless support, including passkeys, to Authenticator.

[pmellaaho]

Hello, it's been a while since you started working on this. Are you able to share your roadmap or any other news regarding this feature? Furthermore, is there any conflict between passwordless support and Autofill support (#247)? I'm just curious because if my longer term goal is to support passwordless Sign-in, should I skip the Autofill support or can they both be used side by side?