Public bug reported:
Release: Ubuntu 26.04.1 LTS (Kubuntu, Plasma 6.6)
Packages: libkscreenlocker6 6.6.5-0ubuntu0.1, libpam-kwallet5 4:6.6.4-0ubuntu1
Summary
-------
When unlocking the Plasma lock screen with a fingerprint, the finger is
accepted immediately but the screen does not unlock. It only unlocks after
pressing Enter (with an empty password field), several seconds
later.
/usr/lib/pam.d/kde-fingerprint (shipped by libkscreenlocker6, added in Debian
6.3.5-1 for Debian bug #1089081) contains:
auth required pam_fprintd.so
auth optional pam_kwallet5.so
After pam_fprintd succeeds, pam_kwallet5 finds no PAM_AUTHTOK and asks
for a password through the PAM conversation. kscreenlocker cannot answer
prompts for its non-interactive authenticators (like kde-fingerprint),
so the stack blocks. When the user presses Enter on the password
authenticator, pam_kwallet5 then fails ("Conversation error"), but it is
optional, so authentication succeeds and the screen unlocks. (the same
probably holds true also for smartcards, /usr/lib/pam.d/kde-smartcard
has the same logic, but this has not been tested)
Steps to reproduce
------------------
1. Enroll a finger on a machine with a working fingerprint reader;
2. Check that the fingerprint is properly recognized (ie fprintd returns
success)
3. Lock the screen, move the mouse to show the password field;
4. Touch the sensor.
Expected: the screen unlocks.
Actual: nothing visible happens; pressing Enter unlocks it immediately.
Log (journalctl --user, one unlock attempt)
-------------------------------------------
10:23:09 kscreenlocker_greet: (greeter starts)
10:23:12 pam_kwallet5(kde-fingerprint:auth): pam_kwallet5: pam_sm_authenticate
10:23:12 pam_kwallet5(kde-fingerprint:auth): pam_kwallet5: Couldn't get
password (it is empty) <- finger accepted at 10:23:12 (success)
10:23:20 pam_unix(kde:auth): authentication failure; ... user=<user> <-
Enter, empty password
10:23:20 pam_kwallet5(kde-fingerprint:auth): pam_kwallet5: Prompt for password
failed Conversation error
10:23:20 pam_kwallet5(kde-fingerprint:setcred): pam_kwallet5: pam_sm_setcred
<- unlocked
Workaround and suggested fix
-------------
Drop "auth optional pam_kwallet5.so" from kde-fingerprint (and probably
kde-smartcard). Without a password, pam_kwallet5 cannot unlock the wallet
anyway, so the line has no benefit in these stacks. gdm3's gdm-fingerprint,
which the comment says these files were taken from, uses pam_gnome_keyring,
which does not prompt in that situation.
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: libkscreenlocker6 6.6.5-0ubuntu0.1
ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14
Uname: Linux 7.0.0-38-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: KDE
Date: Fri Oct 30 10:34:24 2026
InstallationDate: Installed on 2020-02-25 (2439 days ago)
InstallationMedia: Kubuntu 19.10 "Eoan Ermine" - Release amd64 (20191017)
RebootRequiredPkgs: Error: path contained symlinks.
SourcePackage: kscreenlocker
UpgradeStatus: Upgraded to resolute on 2026-10-21 (9 days ago)
modified.conffile..etc.default.apport: [modified]
mtime.conffile..etc.default.apport: 2020-10-16T17:07:32.414229
** Affects: kscreenlocker (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172578
Title:
Fingerprint unlock on the lock screen waits for Enter
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/kscreenlocker/+bug/2172578/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
