This seems a bit like using the password for both purposes.
Technically this works, as long as people are using strong enough passwords all people passwords will be unique (as a good biometric will do), and therefore you can imagine a system where identification too can be accomplished using only a password.
However this would open a big flaw since an attacker will not need to find the authentication matching a certain identity anymore: all he will have to do is guess any valid authentication matching any identity and the access will be granted.
This makes the attacker's task far easier, which in turns makes such system unsuitable as a main access control.
However, in high security environments, such system could be easily adopted as an unobstructive second-line defense:
- At the facility or area entrance you do a traditional identification + authentication check,
- Within the facility or area you implement unobstructive checks avoiding employees to waste their time by identifying themselves each time they want to open a door or cross an hallway, but allowing to detect if someone managed to bypass the main entrance security system.
Now, following your comment, from a more theoretical point-of-view, "if the "password" is strong and unique enough (assuming no attacker can imitate, I know this assumption is impractical though)", then yes the whole identification + authentication system can rely on the authentication process.
Even if it goes out of the biometric world, I can even think of a concrete application of this: X.509 certificates.
While certificates by themselves respect the duality of identification (distinguished name) and authentication (certificate owner's private key), certificate's security actually relies on the fact that every secret keys composing the certification chain's must remain unknown. It is therefore sufficient for an attacker to find any of the private keys composing a certificate's trust chain to break the corresponding certificate-based authentication system (he would then be able to forge new "valid" certificates at will, or use your wording to imitate a valid signature).
This works because certification chains are usually short, they do not count thousands of levels. While it is sufficient for an attacker to find any key, the range of the valid keys remains very narrow while the range of possible keys is very huge, thus keeping such attack impractical (fortunately!). In other words this allow us to assume that an attacker cannot imitate legitimate certificates.
In theory you could expand this to biometric authentication at a given point in time. This does not solve biometric specific issues, but as long as an attacker is not able to find or reproduce any identification/authentication token, no matter what it is, then yes you can merge identification and authentication in a single step.
