I wanted to try out the fingerprint reader in my laptop and installed
fprintd (but not libpam-fprintd yet). I also did not yet configure any
fingerprints.

However after a reboot I could no longer login (I could still unlock
the screen before the reboot). The system journal says:

+---
| Feb 16 09:35:34 gdm-fingerprint][1708]: PAM unable to dlopen(pam_fprintd.so): /lib/security/pam_fprintd.so: cannot open shared object file: No such file or directory
| Feb 16 09:35:34 gdm-fingerprint][1708]: PAM adding faulty module: pam_fprintd.so
| Feb 16 09:35:34 gdm-fingerprint][1708]: gkr-pam: no password is available for user
| Feb 16 09:35:34 gdm-fingerprint][1716]: PAM unable to dlopen(pam_fprintd.so): /lib/security/pam_fprintd.so: cannot open shared object file: No such file or directory
| Feb 16 09:35:34 gdm-fingerprint][1716]: PAM adding faulty module: pam_fprintd.so
| Feb 16 09:35:34 gdm-fingerprint][1716]: gkr-pam: no password is available for user
+---

There was no prompt for the password at all: I chose my user and was
returned back to the user selection.

I logged in via getty and installed libpam-fprintd and could login again.

GDM should not make login impossible when fprintd is installed and
libpam-fprintd is not. Login via password should still be possible in
this case.

I also noticed that for some reason there is a "]" after
"gdm-fingerprint" and before the PID in the log. That might also be a
minor bug.

Ansgar

UI is gnome-shell in a special mode, and it's gnome-shell (in
js/gdm/util.js) that chooses whether to ask gdm to authenticate using
/etc/pam.d/gdm-fingerprint or one of the other gdm-* PAM service names.

At the moment, it chooses gdm-fingerprint if fprintd is installed (as
determined by its D-Bus service name existing) and reports that there is
a suitable fingerprint reader device.

Is there a better way that gnome-shell can detect that libpam-fprintd is
unavailable, preferably without having to hard-code the Debian-specific
and architecture-specific path /lib/x86_64-linux-gnu/security/pam_fprintd.so
or other architectures' equivalents?

Dependencies aren't going to help us here: gdm shouldn't depend on
libpam-fprintd because it works fine without it (indeed that's a more
common configuration), fprintd can't depend on libpam-fprintd because
that would be circular, and apt/dpkg has no syntax for "depends on
libpam-fprintd if fprintd is installed".

In principle the /etc/pam.d/gdm-fingerprint PAM stack could probably
fall back to password authentication, but I'm not sure how that would
be achieved. Marco Trevisan would probably know better?

Other distributions' PAM configurations as shipped by upstream seem to
be for fingerprint authentication only, without allowing a password.

    smcv

GDM does still allow password login as a fallback, but only when
libpam-fprintd is installed. Otherwise login fails before a password
prompt is shown.

Ansgar