How to use Windows Hello / UserConsentVerifier from a Win32 application

[suzukieng]

Hi. I'm extending an existing application with Windows Hello functionality. My setup is a bit special, it's a JavaFX application that uses JNA to access native platform features on Window and macOS.

I digged into Windows Hello, found the UserConsentVerifier and KeyCredentialManager classes, and wrote a quick sample in C#, blissfully unaware that I was writing a UWP app at that moment. I then ported that code to C++/WinRT and built a DLL that my Java application can load and invoke functions using JNI/JNA.

So far, so good. A couple of days into my experiment I noticed something weird happening, the Windows Hello prompt, which is triggered by KeyCredentialManager::RequestSignAsync and UserConsentVerifier::RequestVerificationAsync() appeared behind my application window, effectively rendering it unusable. I reported this behavior to the C++/WinRT project (see: microsoft/cppwinrt#999) and got some amazing support from @kennykerr and @sylveon.

Turns out, after closer study of the docs, the methods I was trying to call use the "request naming pattern" and are not supported (reference: https://docs.microsoft.com/en-us/windows/apps/desktop/modernize/desktop-to-uwp-supported-api#methods-that-use-the-request-naming-pattern).

Methods that follow the Request naming pattern, such as AppCapability.RequestAccessAsync and StoreContext.RequestPurchaseAsync, are not supported in desktop apps. Internally, these methods use the Windows.UI.Popups class. This class requires that the thread have a CoreWindow object, which isn't supported in desktop apps.

The helpful folks in the C++/WinRT project pointed me to the userconsentverifierinterop.h interop header:
https://docs.microsoft.com/en-us/windows/win32/api/userconsentverifierinterop/

I couldn't find a single example of real-world use of IUserConsentVerifierInterop from a Win32 app. Could someone explain to me what I need to do to call this from a DLL loaded into a Java process? I know how to obtain a native HWND for my JavaFX windows, so I suppose I can pass that to IUserConsentVerifierInterop.RqeuestVerificationAsync to get the popup to display correctly.

Also, is there a reason for the interop interface only containing the RequestVerificationAsync method but not the CheckAvailabilityAsync method? Usually you would want to have both, first check if it's available, and then use it.
Also why is there no interop interface for KeyCredentialManager? It would be great to have access to the Hello keypair.

[kennykerr]

cc @jonwis

[suzukieng]

Using some information from the blog post from Raymond (https://devblogs.microsoft.com/oldnewthing/20210805-00/?p=105520) which shows how to call a similar interop API, and some digging in C++/WinRT documentation and sample code I managed to successfully call the interop API (see sample below).

HRESULT user_consent_verifier_request_verification(const char* msg, HWND hWND, IntCallbackType callback)
{
    winrt::hstring msg_h(utf8_decode(std::string(msg)));

    auto activation_factory = winrt::get_activation_factory<UserConsentVerifier>();
    winrt::com_ptr<IUserConsentVerifierInterop> interop{ activation_factory.as<IUserConsentVerifierInterop>() };
    winrt::guid iid_async_op_result{ winrt::guid_of<IAsyncOperation<UserConsentVerificationResult>>() };
    HSTRING msg_hs = static_cast<HSTRING>(get_abi(msg_h));
    winrt::com_ptr<IAsyncOperation<UserConsentVerificationResult>> async_op;
    /* TODO: figure out how to attach delegate
    (*async_op).Completed([callback](auto &&sender, auto &&result) {
        callback(static_cast<int>(result));
    });
    */

    HRESULT hr = interop->RequestVerificationForWindowAsync(hWND, msg_hs, iid_async_op_result, async_op.put_void());
    return hr;
}

The function lives in a DLL and uses C calling-conventions to be able to access it from Java.

extern "C" {
    typedef void (*IntCallbackType)(int value);

    __declspec(dllexport) HRESULT user_consent_verifier_request_verification(const char* msg, HWND HWND, IntCallbackType callback);
}

What I'm stuck with now is something hopefully simpler... I'm trying to attach a Completed delegate to the asynchronous operation (like @kennykerr describes in https://kennykerr.ca/2018/03/08/cppwinrt-handling-async-completion/ ). From there I will pass the result to a C function pointer which was passed in as a parameter to the function. Unfortunately, I can not get it to build and I suspect that my IAsyncOperation is wrapped in a winrt::com_ptr. @kennykerr, might I ask for your insights once more? 🙂

[suzukieng]

Never mind, I figured it out... I was missing the "unpacking" of the winrt::com_ptr using as()

HRESULT user_consent_verifier_request_verification(const char* msg, HWND hWND, IntCallbackType callback)
{
    winrt::hstring msg_h(utf8_decode(std::string(msg)));
    auto activation_factory = winrt::get_activation_factory<UserConsentVerifier>();
    winrt::com_ptr<IUserConsentVerifierInterop> interop{ activation_factory.as<IUserConsentVerifierInterop>() };
    winrt::guid iid_async_op_result{ winrt::guid_of<IAsyncOperation<UserConsentVerificationResult>>() };
    HSTRING msg_hs = static_cast<HSTRING>(get_abi(msg_h));
    winrt::com_ptr<IAsyncOperation<UserConsentVerificationResult>> com_async_op;
    HRESULT hr = interop->RequestVerificationForWindowAsync(hWND, msg_hs, iid_async_op_result, com_async_op.put_void());
    auto async_op = com_async_op.as<IAsyncOperation<UserConsentVerificationResult>>();
    async_op.Completed([callback](auto sender, auto status) {
        callback(static_cast<int>(sender.GetResults()));
        });
    return hr;
}

Yay. I feel like i'm probably the first person doing this from Java... 😂