Bug 2345554 - No fingerprint auth option when laptop wakes from sleep
Summary: No fingerprint auth option when laptop wakes from sleep
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: kscreenlocker
Version: 41
Hardware: x86_64
OS: Linux
unspecified
high
Target Milestone: ---
Assignee: KDE SIG
QA Contact: Fedora Extras Quality Assurance
URL: https://bugs.kde.org/show_bug.cgi?id=...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-02-13 14:40 UTC by chwshka
Modified: 2025-02-15 15:22 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:


Attachments (Terms of Use)
Updates that were applied to cause the issue (194.78 KB, text/plain)
2025-02-13 14:41 UTC, chwshka
no flags Details

Description chwshka 2025-02-13 14:40:43 UTC
I've been using fingerprint authentication for sudo and screen unlocking for a few months. I am not using it for initial login. I've had no issues with fingerprint authentication in all this time, until the 9/10th of February.

Fingerprint authentication still works for sudo authentication and for unlocking the screen after I've manually locked it via Meta + L. However the system is no longer prompting me for fingerprint authentication after it wakes from sleep e.g. I close my laptop lid, wait a minute and then reopen the laptop, I'm no longer prompted with the "or scan your fingerprint on the reader" message and I have to use password auth. The same issue applies if I use the "sleep" option in the application menu.

I see the following fprintd related messages in the journal log after waking from sleep and seeing the missing "or scan your fingerprint on the reader" message on the lock screen.
```
Feb 12 15:47:28 fedora-xps systemd[1]: Starting fprintd.service - Fingerprint Authentication Daemon...
Feb 12 15:47:29 fedora-xps systemd[1]: Started fprintd.service - Fingerprint Authentication Daemon.
Feb 12 15:47:29 fedora-xps fprintd[11244]: Authorization denied to :1.248 to call method 'Claim' for device 'Goodix MOC Fingerprint Sensor': Device was already claimed
Feb 12 15:48:16 fedora-xps fprintd[11244]: Authorization denied to :1.258 to call method 'ListEnrolledFingers' for device 'Goodix MOC Fingerprint Sensor': Not Authorized: net.reactivated.fprint.device.verify
Feb 12 15:49:19 fedora-xps systemd[1]: fprintd.service: Deactivated successfully.
```

I've rolled back to a BTRFS snapshot from February 5th and the fingerprint functionality works fine when waking from sleep. The fprintd authorisation messages also don't appear. However if I apply updates, the problem returns. So it seems like some update between 05/02/2025 and maybe the 9th/10th started the issue. 

I've done some digging and it seems like the fprintd errors are polkit related. Based on this comment (https://github.com/i3/i3lock/issues/210#issuecomment-1033042602) I created two rules in this directory '/etc/polkit-1/rules.d/':

50-net.reactivated.fprint.device.claim.rules
and
50-net.reactivated.fprint.device.verify.rules

After creating these rules, I'm no longer getting the fprintd authorisation denied messages in my journal logs. However the fingerprint authentication is still failing to appear on the unlock screen after the machine goes to sleep.

I also noticed that if I wake the machine from sleep very quickly, the fingerprint authentication option is still there. Under System Settings > Screen Locking I have the "Delay before password required" option set to 30 seconds. If I wake the laptop from sleep before 30 seconds, the fingerprint option is there, but if I wake the laptop after longer than 30 seconds the fingerprint option is no longer there.

I can replicate this behaviour with other time delays for the "Delay before password required" setting. However setting this to "Never require a password" simply means that the machine never locks and isn't suitable for anyone with any security considerations.

So could this be an issue with my settings under pam.d? I'm a bit lost with these settings and especially lost when it comes to how they interact with kscreenlocker.

Regardless, some update clearly caused issues in relation to fprintd and polkit at the very least.

The URL I've attached leads to the KDE error report that I filed. This includes a list of the updates that were applied to cause this issue.

Reproducible: Always

Steps to Reproduce:
1. Put laptop to sleep
2. Wake laptop from sleep
Actual Results:  
Fingerprint login option is missing, I'm forced to use a password. "or scan your fingerprint on the reader" message isn't on the screen below the password field.

Expected Results:  
"or scan your fingerprint on the reader" message should be under the password field and allow me to login using fingerprint

SOFTWARE/OS VERSIONS
Operating System: Fedora Linux 41
KDE Plasma Version: 6.2.5
KDE Frameworks Version: 6.10.0
Qt Version: 6.8.2
Kernel Version: 6.12.11-200.fc41.x86_64 (64-bit)
Graphics Platform: Wayland

Can also replicate on:
Operating System: Fedora Linux 41
KDE Plasma Version: 6.3.0
KDE Frameworks Version: 6.10.0
Qt Version: 6.8.2
Kernel Version: 6.12.11-200.fc41.x86_64 (64-bit)
Graphics Platform: Wayland

Comment 1 chwshka 2025-02-13 14:41:35 UTC
Created attachment 2076350 [details]
Updates that were applied to cause the issue

Comment 2 chwshka 2025-02-15 15:22:33 UTC
I've found a reddit thread where an Arch user is complaining about the same issue
https://www.reddit.com/r/kde/comments/1ikzm9q/fingerprint_unlock_not_working_after_screen/

So this doesn't seem limited to fedora. I've already created a KDE tracker
https://bugs.kde.org/show_bug.cgi?id=499893

So this ticket can potentially be closed since it seems to be a KDE issue rather than a Fedora only issue?


Note You need to log in before you can comment on or make changes to this bug.