One FaceID for multiple operations in a short while

Is this possible?

Yes.

The trick is to attach the same LACContext to your biometric authentication and your keychain items. For the latter, use kSecUseAuthenticationContext. Its docs describe two different ways to approach this.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

I didn't get to work on this problem for a while, but now I think I have pinpointed the root of our problem.

We first use the device check attestation service (DCAppAttestService) that does its thing with the Secure Enclave and then we do something else also with the Secure Enclave.

If I understand right, both the Apple attest service and our keychain code need to use the same LAContext to only prompt for one FaceID or Passcode?

The problem is, I do not know a way to tell the attest service what LAContext to use. It just takes in the keyId String.

DCAppAttestService > generateAssertion

Is there any way to make this work?

We first use the device check attestation service (DCAppAttestService)

Oh, that’s definitely a wrinkle. App attest represents a different path into the SE, one that’s distinct from the usual keychain path. I’ve no idea how to make things work in that case.

Actually…

I’m gonna go further than that: I don’t think it’s currently possible to unify these requests and I recommend that you file a bug asking that we add such. Please post your bug number, just for the record.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Thanks for confirming the findings! I filed a feedback report with the number: FB15077680