iOS, using biometric authentication only for a subset of an apps functionality

Question

I'm working on an app where the user needs to be authenticated for only some of the features, but they are supposed to remain 'anonymous' for the rest of the features. Is there a way to implement biometric authentication within the app when the user tries to access specific features?

For instance, let us say that to participate in an open discussion forum within the app they do not need to authenticate, but once they try to send a direct message they will need to authenticate using Touch ID or Face ID. Can this be done, or can biometric authentication only be used when the user opens the app?

Answer 1

Yes, you can use it anywhere you want to. Just ask for authentication and then, after authentication is successfully completed, show another ViewController.

Answer 2

you can do biometric auth anywhere you want, Here is a sample that you can try:

func authenticationWithTouchID(completion: (Bool) -> ()) {
    let localAuthenticationContext = LAContext()
    localAuthenticationContext.localizedFallbackTitle = "Use Passcode"

    var authError: NSError?
    let reasonString = "To access the secure data"

    if localAuthenticationContext.canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: &authError) {

        localAuthenticationContext.evaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, localizedReason: reasonString) { success, evaluateError in
            if success {
                completion(true)
            } else {
                //TODO: User did not authenticate successfully, look at the error and take appropriate action
                guard let error = evaluateError else { return }
                print(self.evaluateAuthenticationPolicyMessageForLA(errorCode: error._code))
                //TODO: If you have choosen the 'Fallback authentication mechanism selected' (LAError.userFallback). Handle gracefully
                completion(false)
            }
        }
    } else {
        guard let error = authError else { return }
        //TODO: Show appropriate alert if biometry/TouchID/FaceID is lockout or not enrolled
        print(self.evaluateAuthenticationPolicyMessageForLA(errorCode: error.code))
    }
}

func evaluatePolicyFailErrorMessageForLA(errorCode: Int) -> String {
    var message = ""
    if #available(iOS 11.0, macOS 10.13, *) {
        switch errorCode {
            case LAError.biometryNotAvailable.rawValue:
                message = "Authentication could not start because the device does not support biometric authentication."

            case LAError.biometryLockout.rawValue:
                message = "Authentication could not continue because the user has been locked out of biometric authentication, due to failing authentication too many times."

            case LAError.biometryNotEnrolled.rawValue:
                message = "Authentication could not start because the user has not enrolled in biometric authentication."

            default:
                message = "Did not find error code on LAError object"
        }
    } else {
        switch errorCode {
            case LAError.touchIDLockout.rawValue:
                message = "Too many failed attempts."

            case LAError.touchIDNotAvailable.rawValue:
                message = "TouchID is not available on the device"

            case LAError.touchIDNotEnrolled.rawValue:
                message = "TouchID is not enrolled on the device"

            default:
                message = "Did not find error code on LAError object"
        }
    }
    return message;
}

func evaluateAuthenticationPolicyMessageForLA(errorCode: Int) -> String {
    var message = ""
    switch errorCode {

    case LAError.authenticationFailed.rawValue:
        message = "The user failed to provide valid credentials"

    case LAError.appCancel.rawValue:
        message = "Authentication was cancelled by application"

    case LAError.invalidContext.rawValue:
        message = "The context is invalid"

    case LAError.notInteractive.rawValue:
        message = "Not interactive"

    case LAError.passcodeNotSet.rawValue:
        message = "Passcode is not set on the device"

    case LAError.systemCancel.rawValue:
        message = "Authentication was cancelled by the system"

    case LAError.userCancel.rawValue:
        message = "The user did cancel"

    case LAError.userFallback.rawValue:
        message = "The user chose to use the fallback"

    default:
        message = evaluatePolicyFailErrorMessageForLA(errorCode: errorCode)
    }
    return message
}

Now You can use this function anywhere you want

authenticationWithTouchID(completion: {(success) in
    if success {
         //TODO: User authenticated successfully, take appropriate action     
    } else {
         //TODO: User authenticateion failed, take appropriate action
    }
})