[TIMOB-24218] Android: Expose Keychain access in Ti.TouchID (Parity with iOS)
GitHub Issue | n/a |
---|---|
Type | New Feature |
Priority | Critical |
Status | Closed |
Resolution | Fixed |
Resolution Date | 2017-08-09T22:19:41.000+0000 |
Affected Version/s | n/a |
Fix Version/s | Release 6.2.0 |
Components | Android |
Labels | android, keychain-access |
Reporter | Nikita Radaev |
Assignee | Gary Mathews |
Created | 2016-12-13T19:27:07.000+0000 |
Updated | 2017-08-29T23:14:20.000+0000 |
Description
Now that iOS keychain functionality has been sorted out in TIMOB-20547, we would like someone to look into exposing Android Keychain functionality discussed in [https://developer.android.com/reference/android/security/KeyChain.html].
Currently, I believe Android TouchId module can only check for correct/incorrect fingerprint. We would like to actually save key/value pair and hopefully get some additional security features that native code provides.
Some more info about Android keystore here: https://developer.android.com/training/articles/keystore.html
[~nradaev] I had a chat with our R&D and as per them, it took us a bit amount of time to address the iOS ticket and this one might take longer. Currently this is scheduled for Q1/Q2 2017. We apologize for the delay on this. But if you think its critical, please let Saleem know.
master: https://github.com/appcelerator-modules/ti.touchid/pull/32
The CR-review is nearly finished, Gary provided a release to test already, thanks [~gmathews]! https://github.com/appcelerator-modules/ti.touchid/releases/tag/android-2.2.0
Great! Are there any docs available? Attached example shows only the very basic case. As far as I know, Android keystore works slightly different than iOS one. I would like to do some testing on our end as well.
Hi guys, After a quick test I have a few questions: - Is there a support for fingerprint authentication? - Will there be constraints available like accessControlMode and accessibilityMode for iOS TouchID module? One of our use cases is being able to put a value in the keystore with constraints and then retrieve it using fingerprint. I dont believe Android & iOS TouchID modules will have parity without these two features.
[~nradaev] - Yes, [here's an example](https://github.com/appcelerator-modules/ti.touchid/blob/master/android/example/app.js) for fingerprint authentication - Nope, those are iOS specific properties Thanks for the use case, I'll implement the ability to do that on Android.
Hi Gary, Thank you for a quick reply. I will do some additional testing regarding fingerprint authentication. Speaking of constraints, I understand that accessControlMode and accessibilityMode are iOS specific constants and Android keystore is not as granular. However, the use case I was describing above (ability to retrieve keystore value with a fingerprint) also requires that a passcode is setup on device at the moment of writing/reading of keychain items, ideally controlled by some sort of optional value. Basically, we will have some values that have lower security priority and a couple with a high security priority. For lower security items we just need a basic read/write/remove functionality that is currently covered. For higher security items we would like to force user to have some sort of additional device protection setup. I believe this is possible to achieve using spec.setUserAuthenticationRequried(true). It would also be nice if this constraint could include patterns and pins. As far as I understand its also possible to set a timeout period for how long "authentication" lasts since user inserted his pass/pin/pattern. It would be great if you could expose that value as well, as other use cases may arise in the future. So basically we are hoping you could emulate accessiblityMode: ACCESSIBLE_WHEN_PASSCODE_SET. Please let me know your thoughts on this matter, Nikita.
[~nradaev] I have updated the
2.2.0
pre-release: https://github.com/appcelerator-modules/ti.touchid/releases/tag/android-2.2.0Hi Gary, Thanks for coming back to us on this issue. Unfortunately, application build process fails with supplied module. Is there a more stable version I can use? N.
[~nradaev] Updated the pre-release, it should work now.
Thank you Gary! It seems to work correctly. I still have a couple things I want to discuss with about this ticket. I propose we take it up via email in order to avoid clutter here. Could you please contact me at nikita.radaev@meridiancu.ca?
Verified the implementation. Key/value can be saved in the keychain & be retrieved using the fingerprint. Studio Ver: 4.9.1.201707200100 SDK Ver: 6.1.2.GA OS Ver: 10.12.3 Xcode Ver: Xcode 8.3.3 Appc NPM: 4.2.9 Appc CLI: 6.2.3 Ti CLI Ver: 5.0.14 Alloy Ver: 1.9.13 Node Ver: 6.10.1 Java Ver: 1.8.0_101 Devices: ⇨ google Pixel --- Android 7.1.1 Touchid module : 2.2.0
Verified the fix in 6.2.0.v20170818105443. For master the
touchid
module will have to be recompiled to work with 7.0.0. Leaving this in resolved state as of now.PRs to land changes into SDK master: https://github.com/appcelerator/titanium_mobile/pull/9359 6_2_X: https://github.com/appcelerator/titanium_mobile/pull/9360
Verified the fix with SDK 6.2.0.v20170829152447 & 7.0.0.v20170829152646. For 7.0.0.v20170829152646 the touchID module is not selectable in the tiapp.xml and needs to be recompiled to work with it. Closing. Studio Ver: 4.9.1.201707200100 OS Ver: 10.12.3 Xcode Ver: Xcode 8.3.3 Appc NPM: 4.2.9 Appc CLI: 6.2.3 Ti CLI Ver: 5.0.14 Alloy Ver: 1.9.13 Node Ver: 6.10.1 Java Ver: 1.8.0_101 Devices: ⇨ google Nexus 5 --- Android 6.0.1 ⇨ google Pixel --- Android 7.1.1