No fingerprint unlock option after waking from sleep

Help
1

I’ve been using fingerprint authentication for sudo and screen unlocking for a few months. I am not using it for initial login. I’m on Fedora KDE 41 with all updates applied. I’ve had no issues with fingerprint authentication in all this time, until today.

Fingerprint authentication still works for sudo authentication and for unlocking the screen after I’ve manually locked it via Meta + L. However the system is no longer prompting me for fingerprint authentication after it wakes from sleep e.g. I close my laptop lid, wait a minute and then reopen the laptop, I’m no longer prompted with the “or scan your fingerprint on the reader” message and I have to use password auth. The same occurs if I just leave the laptop and it goes to sleep. I come back and I’m not prompted for fingerprint and placing my finger on the scanner does nothing. I’m forced to use my password. Here are the outputs of relevant commands.

I’ve already tried re-enrolling my fingerprint, removing it entirely and enrolling from scratch and various authselect commands.

Can anyone point me in the right direction?

    kinfo
     
    Operating System: Fedora Linux 41 
    KDE Plasma Version: 6.2.5 
    KDE Frameworks Version: 6.10.0 
    Qt Version: 6.8.2 
    Kernel Version: 6.12.11-200.fc41.x86_64 (64-bit) 
    Graphics Platform: Wayland

-

    sudo authselect current
    
    Profile ID: local 
    Enabled features:
    with-silent-lastlog
    with-mdns4
    with-fingerprint

-

    cat /etc/pam.d/sddm
    
    auth     [success=done ignore=ignore default=bad] pam_selinux_permit.so
    auth        substack      password-auth
    -auth        optional      pam_gnome_keyring.so
    -auth        optional      pam_kwallet5.so
    -auth        optional      pam_kwallet.so
    auth        include       postlogin
    
    account     required      pam_nologin.so
    account     include       password-auth
    
    password    include       password-auth
    
    session     required      pam_selinux.so close
    session     required      pam_loginuid.so
    -session    optional    pam_ck_connector.so
    session     required      pam_selinux.so open
    session     optional      pam_keyinit.so force revoke
    session     required      pam_namespace.so
    session     include       password-auth
    -session     optional      pam_gnome_keyring.so auto_start
    -session     optional      pam_kwallet5.so auto_start
    -session     optional      pam_kwallet.so auto_start
    session     include       postlogin

-

    cat /etc/pam.d/kde
    
    auth        substack      password-auth
    auth        include       postlogin
    
    account     required      pam_nologin.so
    account     include       password-auth
    
    password    include       password-auth
    
    session     required      pam_selinux.so close
    session     required      pam_loginuid.so
    session     required      pam_selinux.so open
    session     optional      pam_keyinit.so force revoke
    session     required      pam_namespace.so
    session     include       password-auth
    session     include       postlogin

-

    cat /etc/pam.d/kde-fingerprint
    
    auth        substack      fingerprint-auth
    auth        include       postlogin
    
    account     required      pam_nologin.so
    account     include       fingerprint-auth
    
    password    include       fingerprint-auth
    
    session     required      pam_selinux.so close
    session     required      pam_loginuid.so
    session     required      pam_selinux.so open
    session     optional      pam_keyinit.so force revoke
    session     required      pam_namespace.so
    session     include       fingerprint-auth
    session     include       postlogin
3

This is the entirety of the fprintd journal logs from when I wake the laptop from sleep

Feb 12 15:47:28 fedora-xps systemd[1]: Starting fprintd.service - Fingerprint Authentication Daemon...
Feb 12 15:47:29 fedora-xps systemd[1]: Started fprintd.service - Fingerprint Authentication Daemon.
Feb 12 15:47:29 fedora-xps fprintd[11244]: Authorization denied to :1.248 to call method 'Claim' for device 'Goodix MOC Fingerprint Sensor': Device was already claimed
Feb 12 15:48:16 fedora-xps fprintd[11244]: Authorization denied to :1.258 to call method 'ListEnrolledFingers' for device 'Goodix MOC Fingerprint Sensor': Not Authorized: net.reactivated.fprint.device.verify
Feb 12 15:49:19 fedora-xps systemd[1]: fprintd.service: Deactivated successfully.
4

I’ve done some more testing. I rolled back to a BTRFS snapshot from February 5th and the fingerprint functionality works fine when waking from sleep. However if I apply updates, the problem returns. So it seems like some update between 05/02/2025 and maybe the 9th/10th started the issue.

5

I’ve done some digging and it seems like the fprintd errors are polkit related. Based on the archlinux fprintd page, I created two rules in this directory ‘/etc/polkit-1/rules.d/’:

50-net.reactivated.fprint.device.claim.rules
and
50-net.reactivated.fprint.device.verify.rules

After creating these rules, I’m no longer getting the fprintd authorisation denied messages in my journal logs. However the fingerprint authentication is still failing to appear on the unlock screen after the machine goes to sleep.

I think that I’ve also made another breakthrough. I noticed that if I wake the machine from sleep very quickly, the fingerprint authentication option is still there. Under System Settings > Screen Locking I have the “Delay before password required” option set to 30 seconds. If I wake the laptop from sleep before 30 seconds, the fingerprint option is there, but if I wake the laptop after longer than 30 seconds the fingerprint option is no longer there.

I can replicate this behaviour with other time delays for the “Delay before password required” setting. However setting this to “Never require a password” simply means that the machine never locks and isn’t suitable for anyone with any security considerations.

So could this be an issue with my settings under pam.d? I’m a bit lost with these settings and especially lost when it comes to how they interact with kscreenlocker

6

I’m having the same issue, and I think I know the reason?

It has always been the case that if you wiggle your mouse on the lockscreen so that the password prompt / fingerprint prompt appears, and then you walk away, the fingerprint option times out and you have to use your password. This has always been a bit annoying and I don’t know what to do about it.

Since a recent update, the prompt appears immediately after locking the screen, thus it will always have timed out by the time you want to unlock it again.

1 Like
7

I’ve created a ticket on the KDE and fedora bug trackers.

Although this seems to be a KDE issue because I found a reddit thread where there are Fedora and Arch users complaining about the same issue.

Could you please comment on the KDE bug tracker and share your system information (kinfo command) and any other obersvations you might have? Hopefully that will lead to it getting more traction.

Could you also replicate the bug and share the output of this command

journalctl -b -u fprintd

Are you seeing the same authorisation failure errors that I mentioned?

https://bugs.kde.org/show_bug.cgi?id=499893