The Uniqueness of DNA Paradox
The uniqueness of irises and fingerprints are, as you said, limited to the number of possible permutations of irises and fingerprints. 

A similar problem exists in computer science, and is known as a hash collision. Given sufficient samples, there will always be a collision for a hash of finite size. However, the sample space is sufficiently large for iris and fingerprint analysis for this to not be a problem. 

A typical iris analysis system produces 2048 bits of entropy, while a typical fingerprint analysis system produces about 82 bits. Even accounting for the birthday problem, the information space is large enough that the chance of a given false positive is sufficiently low to prevent a random person from passing fingerprint/iris authentication. 

For comparison, the current world human population is 7.2 billion, or slightly under 33 bits. The risk of a hash collision occurring is small enough to be negligible.

Of course, side-channel attacks against such biometric systems are relatively simple, but that's another issue altogether.