https://bugs.kde.org/show_bug.cgi?id=508247
Bug ID: 508247
Summary: kscreenlocker fingerprint authentication fails after
suspend/resume
Classification: Plasma
Product: plasmashell
Version First 6.3.6
Reported In:
Platform: NixOS
OS: Linux
Status: REPORTED
Severity: crash
Priority: NOR
Component: Screen locking
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: 1.0
Created attachment 184074
--> https://bugs.kde.org/attachment.cgi?id=184074&action=edit
fingerprint.nix (almost working NixOS fingerprint configuration)
SUMMARY
kscreenlocker fails to authenticate using fingerprint (pam_fprintd) after
system suspend/resume cycles. PAM module pam_fprintd is not invoked at all
after resume, forcing password-only authentication.
STEPS TO REPRODUCE
1. Configure fingerprint authentication with pam_fprintd and verify it works
with kscreenlocker (see attachment for a configuration for NixOS)
2. Lock the screen and confirm fingerprint authentication works normally
3. Suspend the system (or wait until it suspends automatically)
4. Wait more than a few minutes (it varies)
5. Resume
6. Touch the fingerprint sensor
OBSERVED RESULT
After resume from suspend:
- kscreenlocker UI appears to offer fingerprint authentication
- pam_fprintd is never invoked (confirmed via system logs)
- Authentication attempts skip directly to pam_unix (password authentication)
- Only password authentication works until user session (or
kscreenlocker_greet) restart
EXPECTED RESULT
Fingerprint authentication should continue working after suspend/resume cycles,
with pam_fprintd being invoked normally as it was before suspend.
SOFTWARE/OS VERSIONS
Windows: N/A
macOS: N/A
Linux/KDE Plasma: NixOS 25.05
KDE Plasma Version: 6.3.6
KDE Frameworks Version: 6.14.0
Qt Version: 6.9.1
ADDITIONAL INFORMATION
kscreenlocker seems to establish its PAM session context at startup and does
not reinitialize after resume. When fprintd restarts after resume (required for
USB device reinitialization), the existing kscreenlocker process retains a
stale PAM session that cannot communicate with the restarted fprintd service.
System logs show:
- Before suspend: kscreenlocker_greet[PID]: pam_fprintd(kde-fingerprint:auth):
[normal fingerprint activity]
- After resume: kscreenlocker_greet[SAME_PID]: pam_unix(kde-fingerprint:auth):
authentication failure
(pam_fprintd never called)
Workaround:
1. Use password authentication
2. Add a system services that restarts the lockscreen greeter:
pkill -TERM kscreenlocker_greet
--
You are receiving this mail because:
You are watching all bug changes.
