After upgrading libpam-kwallet-common from 6.7.4-1 to 6.7.4-3,
fingerprint authentication started requesting the account password after a
successful fingerprint match in sudo and PolicyKit authentication dialogs.

The upgrade installs /usr/share/pam-configs/kde-kwallet with "Default: yes"
and runs pam-auth-update.  This adds the following Additional auth module to
/etc/pam.d/common-auth:

    auth optional pam_kwallet5.so

common-auth is used by sudo, PolicyKit and many services which are unrelated
to graphical session login.  When pam_fprintd authenticates the user, no
PAM_AUTHTOK password is available.  pam_kwallet5 then starts another PAM
conversation asking for the password.  This makes fingerprint authentication
appear to have failed and prevents passwordless completion of the operation.

The relevant journal messages after touching the enrolled finger are:

    pam_kwallet5(sudo:auth): pam_sm_authenticate
    pam_kwallet5(sudo:auth): Couldn't get password (it is empty)
    pam_kwallet5(sudo:auth): Prompt for password failed Conversation error

The fingerprint reader and enrollment remain functional: fprintd-verify
successfully matches the enrolled finger.  The problem occurs with both sudo
and a pkexec PolicyKit dialog.

Steps to reproduce:

1. Enroll a fingerprint and enable the fprintd pam-auth-update profile.
2. Install or upgrade to libpam-kwallet-common 6.7.4-3, accepting its
   default-enabled kde-kwallet profile.
3. Run "sudo -k; sudo true" and authenticate with the enrolled finger.

Expected result:

The successful fingerprint match completes sudo authentication.

Actual result:

pam_kwallet5 requests the user's password after the fingerprint match.

Disabling the newly added global profile immediately restores fingerprint
authentication:

    sudo pam-auth-update --package --disable kde-kwallet

KWallet PAM integration needs to be limited to graphical login services, or
pam_kwallet5 needs to return without prompting when a preceding authentication
module succeeded without setting PAM_AUTHTOK.  Enabling this profile globally
by default is unsafe for authentication methods which do not produce a
password token.

This is a regression introduced by the pam-configs integration added in
6.7.4-2 and enabled during the upgrade to 6.7.4-3.

Hey,

it is very unfortunate, that you face an issue with pam integration for
KWallet because of fingerprint authentication. We added this pam-configs in
order to allow not only sddm to open kwallet with the user password but all
login managers (#1144267). Maybe duck can help there as author of the pam-
config and the feuture request. Maybe they can help to find a solution, that
disables this config for sudo and PolicyKit authentication.

But if I look at /etc/pam.d/kde-fingerprint (shipped bylibkscreenlocker6)  I
see also this line you mention:

    auth    optional        pam_kwallet5.so

so I'm unsure if that line is really the issue for your broken fingerprint
authentication.

Regards,

hefee