** Description changed: [ Impact ] Users logging in through authd's device code flow in GDM may be unable to complete their login. After the user successfully authenticates with the identity provider, authd advances to the local-password challenge. The QR-code/device-authentication UI disappears, but the "Create a local password" entry is not displayed. The user cannot continue and must use the back button to return to the previous stage and retry the login. The issue is caused by GNOME Shell retaining the previous authd mechanism when authd reports that authentication should advance to the next challenge. The stale mechanism prevents the replacement local- password mechanism from being activated. The fix is to clear the UI-visible mechanisms when authd advances to the next challenge. [ Test Plan ] Use a clean Ubuntu Resolute Desktop VM with authd installed from - resolute-updates. Use the existing GDM end-to-end test is available at: + resolute-updates. Use the existing GDM end-to-end test that is available + at: https://github.com/canonical/authd/blob/main/e2e-tests/tests/login_gdm.robot The test logs in through the GDM greeter using device-code authentication, verifies that the local-password creation prompt is displayed, creates the local password, verifies that the GNOME keyring is unlocked and that the user and home directory were created, logs out, and then logs in again using the new local password. Run the test ten times with the current Resolute gnome-shell package. With the affected package, the local-password entry is expected to be missing in some runs and the test will fail when the login cannot be completed. Install the proposed gnome-shell package and repeat exactly the same tests with the same Resolute authd and broker versions. Each run must: 1. Complete device-code authentication through the GDM greeter. 2. Display the "Create a local password" entry after successful device-code authentication. 3. Successfully create the local password and log in. 4. Successfully log out and log in again using the newly created local password. [ Where problems could occur ] The upload changes only the Ubuntu authd integration in GNOME Shell. When the authd handler receives AuthResult.Next, it clears the previously published authd mechanisms and notifies GDM's ShellUserVerifier that the mechanism list has changed. If this notification is emitted at the wrong time, GNOME Shell could clear an authd mechanism while an authentication request is still active. This could result in a missing or blank authentication prompt, failure to accept the current credential, or failure to activate the replacement challenge. The problem would be visible during transitions between authd challenges. The change does not modify the authd protocol, broker authentication, or GNOME Shell's non-authd authentication methods. Possible regressions should therefore appear as failures in authd's GDM flow, such as a missing authentication mode, an unusable password prompt, or an authd login that returns to the greeter. Repeating the complete device-code and local-password flow should detect these regressions. [ Other Info ] This bug originally occurred only sporadically because it was often masked by a duplicate auth-mode selection in the authd/GDM interaction. Before authd PR #1623, GDM echoed the auth-mode selection sent by the adapter, and authd treated that echo as a new selection. This resulted in a second SelectAuthenticationMode request and an additional UI- layout/mechanism update. Although the duplicate request could occasionally create a device-code mismatch, the extra update could also refresh GNOME Shell's stale mechanism state and hide this bug. authd PR #1623 (https://github.com/canonical/authd/pull/1623) fixed the duplicate-selection issue. This removed the accidental mechanism refresh. With #1623 and an unpatched GNOME Shell, the stale mechanism is exposed on almost every login attempt: after authd returns AuthResult.Next, the old authd mechanism remains published and suppresses the local-password mechanism. Related authd issue: https://github.com/canonical/authd/issues/1424
-- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to gnome-shell in Ubuntu. https://bugs.launchpad.net/bugs/2160622 Title: Local password entry may not appear after successful device authentication To manage notifications about this bug go to: https://bugs.launchpad.net/authd/+bug/2160622/+subscriptions -- desktop-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/desktop-bugs
