Bug 498926

Summary: Fingerprint authentication does not unlock default keyring
Product: [Fedora] Fedora Reporter: Dawid Zamirski <dzrudy>
Component: pam_fprintAssignee: Orphan Owner <extras-orphan>
Status: CLOSED WONTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: low Docs Contact:
Priority: low    
Version: 14CC: a.velios, bnocera, extras-orphan, fedora, giallu, hajo, jmccann, liblit, marbolangos, mclasen, mrlhwliberty, pobara, redhat-bugzilla, rstrode, walicki, wielkipiec, yasir.elsharif
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 848987 (view as bug list) Environment:
Last Closed: 2012-08-16 18:07:05 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Dawid Zamirski 2009-05-04 14:04:09 UTC
Description of problem:
I have just gave a try the new fingerprint support in upcoming Fedora 11 and after installing gdm-plugin-fingerprint to enable the fingerprint authentication everything seemed to be ok. However, after authentication with my fingerprint scanner, NetworkManager asked me for my password to unlock the default keyring so I still had to type in my password. 

Version-Release number of selected component (if applicable):
gdm-plugin-fingerprint 1:2.26.1-4.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Install gdm-plugin-fingerprint package and setup your fingerprint authentication in the user info tool.
2. Logout
3. Login using your fingerprint scanner.
  
Actual results:
Default keyring still requires to type in user password.

Expected results:
Once authenticated in GDM with the fingerprint scanner default keyring should be unlocked as well - like it is with regular password authentication.

Additional info:

Comment 1 Matthias Clasen 2009-05-04 16:22:22 UTC
That is not an easy thing to do, since the keyring is locked with your password. If you don't enter your password, it is not available for unlocking the keyring.
Same thing with automatic login.

Comment 2 Dawid Zamirski 2009-05-04 16:58:18 UTC
Uh ok, I guess that GNOME would need to implement unlocking the keyring via fingerprint in order to enable such support. AFAIK the current fingerprint authentication is implemented around PAM and PAM is not used for keyrings right?

Comment 3 Martin Ebourne 2009-05-18 22:43:48 UTC
Presumably the keyring is *encrypted* with your password and therefore it is impossible to unlock the keyring by use of a fingerprint device. To make this work you'd have to forgo encryption of the keyring, which is probably not a great idea.

Comment 4 Bug Zapper 2009-06-09 15:07:26 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 11 development cycle.
Changing version to '11'.

More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Comment 5 Bug Zapper 2010-04-27 14:06:47 UTC
This message is a reminder that Fedora 11 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 11.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '11'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 11's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 11 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Comment 6 Ben Liblit 2010-04-27 16:05:13 UTC
This is definitely still a problem under Fedora 12, but I do not have the power to update the "Version" field accordingly.  Would someone please do that?  Thanks!

Comment 7 Patryk Obara 2010-08-24 13:38:04 UTC
This is still problem under Fedora 13, can Version field be updated again? Shouldn't status of this bug be ASSIGNED instead of NEW?

Comment 8 Dawid Zamirski 2010-08-24 14:14:29 UTC
Patryk, I have just set the version to 13.

Comment 9 Howard Ning 2010-10-13 02:22:59 UTC
The problem is still there in Fedora 14

Comment 10 HaJo Schatz 2011-03-08 10:54:05 UTC
It seems to be easy for Ubuntu, why not for Fedora: http://johnny.chadda.se/article/unlock-the-gnome-keyring-upon-login/

Comment 11 HaJo Schatz 2011-03-08 10:56:05 UTC
Apologies, my mistake. Should have been reading carefully before posting. Please ignore previous comment :(

Comment 12 Fabien Archambault 2011-05-20 12:27:33 UTC
Same in F15 (all updates done).

Comment 13 Ray Strode [halfline] 2011-05-25 01:07:27 UTC
This would be a useful feature but is sort of "hard" to implement.  it would probably involve using the fingerprint hash as a key.

Honestly, this would be better as upstream pam_fprint RFE.

Comment 14 Fedora End Of Life 2012-08-16 18:07:09 UTC
This message is a notice that Fedora 14 is now at end of life. Fedora 
has stopped maintaining and issuing updates for Fedora 14. It is 
Fedora's policy to close all bug reports from releases that are no 
longer maintained.  At this time, all open bugs with a Fedora 'version'
of '14' have been closed as WONTFIX.

(Please note: Our normal process is to give advanced warning of this 
occurring, but we forgot to do that. A thousand apologies.)

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, feel free to reopen 
this bug and simply change the 'version' to a later Fedora version.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we were unable to fix it before Fedora 14 reached end of life. If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora, you are encouraged to click on 
"Clone This Bug" (top right of this page) and open it against that 
version of Fedora.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Comment 15 Yasir M Elsharif 2012-09-20 14:04:16 UTC
The issue is still there in Fedora 17!

Comment 16 Kamil J. Dudek 2012-10-08 18:32:45 UTC
Surprisingly, this issue was never directly mentioned as a "to-do" thing: 
http://fedoraproject.org/wiki/Features/Fingerprint

But it seems "natural" that it should work that way - fingerprint logon's point is to avoid entering password. Instead, it introduces more steps: now not only you have to swipe the finger, but also enter the password for the keyring. I know the second one is optional, but it does not change the fact that fingerprint login provides a crippled session. It works in Ubuntu, but not in the latest Rawhide. This is unusual.

But we all know that. What matters is that the implementation might introduce a temporary and unwanted mess. But I think that this is the feature that should find its way to Fedora. Some day, at least. Is there a way to... "reconsider" the WONTFIX status?

Comment 17 Ray Strode [halfline] 2012-10-09 19:14:53 UTC
It's an issue we're acutely aware of and want to fix at some point, but it's not trivial. Just because this bug report is closed, doesn't mean the issue is won't eventually be dealt with (we were even talking about it this last weekend at the gnome boston summit)

Comment 18 Fabien Archambault 2013-10-03 12:11:01 UTC
Is there any updates? This is still anoying with F19 and all updates done. It defines the fingerprint login as more complex and useless considering on the first launch of any keyring process you must type the password...