Windows Hello/Iris/Pin Authentication with HL2 and Windows 21H1

[mevsie]

We've hit a pretty serious issue with Authentication when our HoloLens 2 devices automatically upgraded to Windows 21H1. The call we are using UserConsentVerifier.RequestVerificationAsync either returns Canceled or doesn't return. Checked on the Slack pages and another development team have hit the same issue and I've added a response to their observation.

Tried with Unity 2019.4.17f1 and 2019.4.26f1. Packages work ok against a HL2 with an older version of Windows, but it's broken for Windows 21H1. Has anyone here spotted anything similar/have a work around/sympathy?

[polar-kev]

Hey @mevsie, this is external a bug external to the MRTK. Please follow the instructions here to file this bug against the HoloLens, https://docs.microsoft.com/en-us/hololens/hololens-feedback

[mevsie]

Issue was resolved by explicitly running the command on the UI thread - hat tip to Steve Leigh on the HoloDevelopers slack page.

[john-jeffri]

Hi, How do I implement this Iris login into my Unity project? I've searched all over the internet and couldn't find it. Can you guys help?

[john-jeffri]

Thank you very much for your contributions. I figured it out by myself. ✌🏽

[john-jeffri]

If anyone wants to Implement this feature I'm adding the code here.

`using UnityEngine;
using System;
using TMPro;
using System.Threading.Tasks;
using LoginManager;

public class IrisLogin : MonoBehaviour
{
public TextMeshPro debugText; //For debugging purpose, exclude in actual project.
public string userName = "MixedReality Four";

private void Start()
{
    CheckLogin();
}

private async void CheckLogin()
{
    bool canLogin = await LoginHelper.LocalLoginAvailableCheckAsync();
    if (canLogin)
    {
        debugText.text = "Credentials is setup!";
        await LoginHelper.CreateKeyAsync(userName, debugText);
    }
    else
    {
        debugText.text = "Credentials not setup!\nPlease go to Windows Settings and set up a PIN to use it.";
    }
}

}`

`using UnityEngine;
using System;
using TMPro;
using System.Threading.Tasks;
#if WINDOWS_UWP
using Windows.Security.Credentials;
#endif

namespace LoginManager
{
public static class LoginHelper
{
public static async Task LocalLoginAvailableCheckAsync()
{
#if WINDOWS_UWP
bool keyCredentialAvailable = await KeyCredentialManager.IsSupportedAsync();
if (keyCredentialAvailable)
{
return true;
}
#endif
Debug.Log("Credentials not setup!\nPlease go to Windows Settings and set up a PIN to use it.");
await Task.CompletedTask;
return false;
}

    public static async Task<bool> CreateKeyAsync(string accountId, TextMeshPro debugText)
    {

#if WINDOWS_UWP
KeyCredentialRetrievalResult keyCreationResult = await KeyCredentialManager.RequestCreateAsync(accountId, KeyCredentialCreationOption.ReplaceExisting);

    switch (keyCreationResult.Status)
    {
        case KeyCredentialStatus.Success:
        debugText.text = "Successfully made key.";
            return true;
        case KeyCredentialStatus.UserCanceled:
        debugText.text = "User cancelled sign-in process.";
            break;
        case KeyCredentialStatus.NotFound:
              debugText.text = "Credentials not setup!\nPlease go to Windows Settings and set up a PIN to use it.";
                        break;
        default:
            break;
    }

#endif
await Task.CompletedTask;
return false;
}
}
}`

[john-jeffri]

After the Hololens got updated to 20XXX the above script stopped working. I can see the CredDialogHost.exe running with the help of Hololens portal. But the Iris scanner doesn't show in the lens. It used to work before in Hololens 19XXX. Any idea what went wrong?

[mevsie]

Make a helper class to run the function on the UI thread. e.g. LaunchHelper

    /// <summary>
    /// Runs the asynchronous function on the UI thread.
    /// </summary>
    /// <param name="asyncFunc">The asynchronous function.</param>
    public static async Task<T> RunAsyncUIMethod<T>(Func<Task<T>> asyncFunc)
    {
        var dispatcher = GetUIDispatcher();
        return await dispatcher.RunTaskAsync(() => asyncFunc());
    }

    /// <summary>
    /// Runs the asynchronous method on the UI thread.
    /// </summary>
    /// <param name="asyncFunc">The asynchronous function.</param>
    public static async Task RunAsyncUIMethod(Func<Task> asyncFunc)
    {
        var dispatcher = GetUIDispatcher();
        await dispatcher.RunTaskAsync(() => asyncFunc());
    }

Then call the request verification via the helper - e.g.

			var consentResult = await LaunchHelper.RunAsyncUIMethod(async () =>
			{
				return await UserConsentVerifier.RequestVerificationAsync(reason);
			});

[john-jeffri]

Will check this one out and get back to you.

[john-jeffri]

GetUIDispatcher() What this class do? Is this in Windows library or I have to create this? I'm little confused.

[john-jeffri]

` public static async Task CreateKeyAsync(string accountId)
{
string message = "Create key async";
IrisLogin.message = message;
await Task.Run(async () =>
{
#if WINDOWS_UWP
IrisLogin.message = message = "Inside WINDOWS_UWP";

            var consentResult = await UserConsentVerifier.RequestVerificationAsync(message);

    switch (consentResult)
    {
        case UserConsentVerificationResult.Verified:
            message = "Fingerprint verified.";
            break;
        case UserConsentVerificationResult.DeviceBusy:
            message = "Biometric device is busy.";
            break;
        case UserConsentVerificationResult.DeviceNotPresent:
            message = "No biometric device found.";
            break;
        case UserConsentVerificationResult.DisabledByPolicy:
            message = "Biometric verification is disabled by policy.";
            break;
        case UserConsentVerificationResult.NotConfiguredForUser:
            message = "The user has no fingerprints registered. Please add a fingerprint to the " +
                            "fingerprint database and try again.";
            break;
        case UserConsentVerificationResult.RetriesExhausted:
            message = "There have been too many failed attempts. Fingerprint authentication canceled.";
            break;
        case UserConsentVerificationResult.Canceled:
            message = "Fingerprint authentication canceled.";
            break;
        default:
            message = "Fingerprint authentication is currently unavailable.";
            break;
    }

#endif
await Task.CompletedTask;
});

        IrisLogin.message = message;
    }`

I'm running the code inside Task.Run. Which I'm thinking will run the code in a different thread?

[mevsie]

It's about making sure that the stuff runs on the main thread - rather than any old thread. Here's the code I missed off, sorry about that.

    /// <summary>
    /// Gets the UI dispatcher.
    /// </summary>
    /// <returns></returns>
    public static CoreDispatcher GetUIDispatcher()
    {
        return Windows.ApplicationModel.Core.CoreApplication.MainView.CoreWindow.Dispatcher;
    }

[john-jeffri]

using UnityEngine;
using System;
using TMPro;
using System.Threading.Tasks;
using LoginManager;
using System.Threading;
#if WINDOWS_UWP
using Windows.UI.Core;
using Windows.Security.Credentials;
using Windows.Security.Credentials.UI;
#endif

public class IrisLogin : MonoBehaviour
{
public TextMeshProUGUI debugText; //For debugging purpose, exclude in actual project.
public string userName = "";
public static string message = "";

public async void CheckLogin()
{
    debugText.text = message = "Check login!";
    await Task.Run(async () =>
   {
       bool canLogin = await LocalLoginAvailableCheckAsync();
       if (canLogin)
       {
           try
           {
               await LoginHelper.RunAsyncUIMethod(async () => { await CreateKeyAsync(userName); });
           }
           catch (Exception error)
           {
               message = error.ToString();
           }
       }
       else
       {
           message = "Credentials not setup!\nPlease go to Windows Settings and set up a PIN to use it.";
       }
   });

    debugText.text = message;
    await Task.CompletedTask;
}

public static async Task<bool> LocalLoginAvailableCheckAsync()
{
    var keyCredentialAvailable = false;
    await Task.Run(async () =>
    {

#if WINDOWS_UWP
keyCredentialAvailable = await KeyCredentialManager.IsSupportedAsync();
return keyCredentialAvailable;
#endif
await Task.CompletedTask;
});
return keyCredentialAvailable;
}

public static async Task CreateKeyAsync(string accountId)
{
    string text = "Create Key Async";
    await Task.Run(async () =>
    {

#if WINDOWS_UWP
text = "Inside WINDOWS_UWP";
var keyCreationResult = await KeyCredentialManager.RequestCreateAsync(accountId, KeyCredentialCreationOption.ReplaceExisting);
text = $"Credentials status: {keyCreationResult.Status}";

        switch (keyCreationResult.Status)
        {
            case KeyCredentialStatus.CredentialAlreadyExists:
                text = "Credentials already exists.";
                break;
            case KeyCredentialStatus.NotFound:
                text = "Credentials not found!\nPlease go to Windows Settings and set up a PIN to use it.";
                break;
            case KeyCredentialStatus.SecurityDeviceLocked:
                text = "Security device is locked.";
                break;
            case KeyCredentialStatus.Success:
                text = "Successfully made key.";
                break;
            case KeyCredentialStatus.UnknownError:
                text = "Credentials encountered an unknown error.";
                break;
            case KeyCredentialStatus.UserCanceled:
                text = "User cancelled sign-in process.";
                break;
            case KeyCredentialStatus.UserPrefersPassword:
                text = "User prefers to enter a password.";
                break;
        }

        //var consentResult = await UserConsentVerifier.RequestVerificationAsync(text);

        //switch (consentResult)
        //{
        //    case UserConsentVerificationResult.Verified:
        //        text = "Fingerprint verified.";
        //        break;
        //    case UserConsentVerificationResult.DeviceBusy:
        //        text = "Biometric device is busy.";
        //        break;
        //    case UserConsentVerificationResult.DeviceNotPresent:
        //        text = "No biometric device found.";
        //        break;
        //    case UserConsentVerificationResult.DisabledByPolicy:
        //        text = "Biometric verification is disabled by policy.";
        //        break;
        //    case UserConsentVerificationResult.NotConfiguredForUser:
        //        text = "The user has no fingerprints registered. Please add a fingerprint to the " +
        //                        "fingerprint database and try again.";
        //        break;
        //    case UserConsentVerificationResult.RetriesExhausted:
        //        text = "There have been too many failed attempts. Fingerprint authentication canceled.";
        //        break;
        //    case UserConsentVerificationResult.Canceled:
        //        text = "Fingerprint authentication canceled.";
        //        break;
        //    default:
        //        text = "Fingerprint authentication is currently unavailable.";
        //        break;
        //}

#endif
await Task.CompletedTask;
});

    message = text;
}

}

[john-jeffri]

using System;
using System.Threading;
using System.Threading.Tasks;
#if WINDOWS_UWP
using Windows.UI.Core;
using Windows.Security.Credentials;
using Windows.Security.Credentials.UI;
#endif

namespace LoginManager
{
public static class LoginHelper
{
///

/// Runs the asynchronous method on the UI thread.
///

/// The asynchronous function.
public static async Task RunAsyncUIMethod(Func asyncFunc)
{
#if WINDOWS_UWP
var dispatcher = GetUIDispatcher();
await dispatcher.RunAsync(CoreDispatcherPriority.Normal, () => asyncFunc());
#endif
}

    /// <summary>
    /// Gets the UI dispatcher.
    /// </summary>
    /// <returns></returns>

#if WINDOWS_UWP
public static CoreDispatcher GetUIDispatcher()
{
return Windows.ApplicationModel.Core.CoreApplication.MainView.CoreWindow.Dispatcher;
}
#endif
}
}

[john-jeffri]

@mevsie This is how I've managed to do. Still I'm not able to make it work.

[mevsie]

You're running the method CreateKeyAsync on the UI thread, but then are executing the majority of the method on another thread using task.run. i.e. get rid of the extra task.run.

[john-jeffri]

Ok. I removed extra task.run from my code. Still the CredDialogHost is running on my lens but It's not showing up.

[john-jeffri]

Ok, I finally made this to work. All you need is three scripts.

I'm attaching the scripts in this post as well.
IrisLogin.txt is for initiating the Iris scanner. Add this to any gameObject.
LoginManger.txt helper class contains the method to fetch the result of the iris scan.
DispatcherTaskExtensions.txt is an extension class that will help the code to run in UI thread.

Thank you @mevsie for spending time with me on this task. You missed to mention the extension class.

DispatcherTaskExtensions.txt
IrisLogin.txt
LoginManager.txt