Hey, it is very unfortunate, that you face an issue with pam integration for KWallet because of fingerprint authentication. We added this pam-configs in order to allow not only sddm to open kwallet with the user password but all login managers (#1144267). Maybe duck can help there as author of the pam- config and the feuture request. Maybe they can help to find a solution, that disables this config for sudo and PolicyKit authentication.
But if I look at /etc/pam.d/kde-fingerprint (shipped bylibkscreenlocker6) I
see also this line you mention:
auth optional pam_kwallet5.so
so I'm unsure if that line is really the issue for your broken fingerprint
authentication.
Regards,
hefee
--
On Montag, 31. August 2026 18:07 Kilian Cavalotti wrote:
> Package: libpam-kwallet-common
> Version: 6.7.4-3
> Severity: important
>
> After upgrading libpam-kwallet-common from 6.7.4-1 to 6.7.4-3,
> fingerprint authentication started requesting the account password after a
> successful fingerprint match in sudo and PolicyKit authentication dialogs.
>
> The upgrade installs /usr/share/pam-configs/kde-kwallet with "Default: yes"
> and runs pam-auth-update. This adds the following Additional auth module to
> /etc/pam.d/common-auth:
>
> auth optional pam_kwallet5.so
>
> common-auth is used by sudo, PolicyKit and many services which are unrelated
> to graphical session login. When pam_fprintd authenticates the user, no
> PAM_AUTHTOK password is available. pam_kwallet5 then starts another PAM
> conversation asking for the password. This makes fingerprint
> authentication appear to have failed and prevents passwordless completion
> of the operation.
>
> The relevant journal messages after touching the enrolled finger are:
>
> pam_kwallet5(sudo:auth): pam_sm_authenticate
> pam_kwallet5(sudo:auth): Couldn't get password (it is empty)
> pam_kwallet5(sudo:auth): Prompt for password failed Conversation error
>
> The fingerprint reader and enrollment remain functional: fprintd-verify
> successfully matches the enrolled finger. The problem occurs with both sudo
> and a pkexec PolicyKit dialog.
>
> Steps to reproduce:
>
> 1. Enroll a fingerprint and enable the fprintd pam-auth-update profile.
> 2. Install or upgrade to libpam-kwallet-common 6.7.4-3, accepting its
> default-enabled kde-kwallet profile.
> 3. Run "sudo -k; sudo true" and authenticate with the enrolled finger.
>
> Expected result:
>
> The successful fingerprint match completes sudo authentication.
>
> Actual result:
>
> pam_kwallet5 requests the user's password after the fingerprint match.
>
> Disabling the newly added global profile immediately restores fingerprint
> authentication:
>
> sudo pam-auth-update --package --disable kde-kwallet
>
> KWallet PAM integration needs to be limited to graphical login services, or
> pam_kwallet5 needs to return without prompting when a preceding
> authentication module succeeded without setting PAM_AUTHTOK. Enabling this
> profile globally by default is unsafe for authentication methods which do
> not produce a password token.
>
> This is a regression introduced by the pam-configs integration added in
> 6.7.4-2 and enabled during the upgrade to 6.7.4-3.
>
>
> -- System Information:
> Debian Release: forky/sid
> APT prefers testing
> APT policy: (900, 'testing'), (900, 'stable'), (500, 'stable-updates'),
> (500, 'stable-security'), (90, 'unstable') Architecture: amd64 (x86_64)
>
> Kernel: Linux 7.1.8+deb14.1-amd64 (SMP w/20 CPU threads; PREEMPT)
> Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
> Locale: LANG=en_US.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8) (ignored: LC_ALL
> set to C.UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash
> Init: systemd (via /run/systemd/system)
> LSM: AppArmor: enabled
>
> Versions of packages libpam-kwallet-common depends on:
> ii init-system-helpers 1.69+nmu1
> ii plasma-version [plasma-version-base-6.7] 6.7.0
> ii socat 1.8.1.3-2
>
> libpam-kwallet-common recommends no packages.
>
> libpam-kwallet-common suggests no packages.
>
> -- no debconf information
signature.asc
Description: This is a digitally signed message part.
