App Crash BiometricDecryptionActivity.onCreate

[slaldmi]

Describe the bug?

I am using okra BOM 2.0.2 version with biometric strong with redirect model in my android app.
We are not facing some crashes reported to play store user in firebase crashlytics dashboard. After investigating the crash we found that app is getting crash from okta SDK.

Attaching stack trace log here

Fatal Exception: java.lang.RuntimeException: Unable to start activity ComponentInfo{com.cfna.app/com.okta.authfoundation.BiometricDecryptionActivity}: kotlin.UninitializedPropertyAccessException: lateinit property biometricAction has not been initialized
at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:3645)
at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:3782)
at android.app.servertransaction.LaunchActivityItem.execute(LaunchActivityItem.java:101)
at android.app.servertransaction.TransactionExecutor.executeCallbacks(TransactionExecutor.java:135)
at android.app.servertransaction.TransactionExecutor.execute(TransactionExecutor.java:95)
at android.app.ActivityThread$H.handleMessage(ActivityThread.java:2307)
at android.os.Handler.dispatchMessage(Handler.java:106)
at android.os.Looper.loopOnce(Looper.java:201)
at android.os.Looper.loop(Looper.java:288)
at android.app.ActivityThread.main(ActivityThread.java:7872)
at java.lang.reflect.Method.invoke(Method.java)

What is expected to happen?

App should not crash and crash should ideally handled

What is the actual behavior?

App is crashing and user is unable to use app

Reproduction Steps?

found user on firebase crashlytics dashboard

Additional Information?

No response

SDK Version and Artifact(s) used.

OKTA
BOM 2.0.2
com.okta.kotlin:auth-foundation
com.okta.kotlin:web-authentication-ui

Boimetric libs
androidx.security:security-crypto:1.1.0-alpha06
androidx.biometric:biometric:1.1.0

Build Information

This issue is reported to play store build users on firebase crashlytics dashboard

[rajdeepnanua-okta]

Hi @slaldmi, are you using biometric credentials with this SDK? If you are, your app is expected to provide biometric prompt details to the SDK before fetching and storing credentials. For example: https://github.com/okta/okta-mobile-kotlin?tab=readme-ov-file#setting-biometric-security-for-new-credentials-globally

It is possible to store a biometric-encrypted credential without the biometric prompt, but your app will need to specify the prompt before fetching the biometric credentials.

If your app is not using biometric credentials, another possibility is that a user is trying to reverse-engineer your app. BiometricDecryptionActivity is not exported, but it's possible to still launch it using elevated privileges (through rooting or emulator). We have observed this user behavior with one of our own apps as well.

[slaldmi]

@rajdeepnanua-okta

Thank you for reply.

Yes, I am using biometric credentials with this SDK and have already followed the steps mentioned in above link to set up biometric of type BiometricManager.Authenticators.BIOMETRIC_STRONG.

Till now this crash is reported once on firebase crashlytics dashboard yet and we are still monitoring.