Plasma Login Manager + Fingerprint: extra “Unlock” step and KWallet behavior

Help
1

Hi everyone,

I’m testing the new Plasma Login Manager with fingerprint authentication and I’d like to share my experience and ask for guidance.

What happens:

  • After a cold boot, if I log in using fingerprint, the session authenticates correctly.

  • However, the login screen still shows an “Unlock” button that I must click to fully enter the session.

  • After login, KWallet is not unlocked automatically and asks for the password.

  • If I log in with password instead (first login after boot), KWallet unlocks normally and the session flow feels complete.

  • After that, using fingerprint for screen lock/unlock works fine.

My understanding so far:

  • Fingerprint authenticates the user but does not provide the password to PAM.

  • KWallet and some session services still rely on password-based unlock.

  • The extra “Unlock” button seems to finalize session initialization.

My questions:

  • Is this the expected behavior of the new Plasma Login Manager?

  • Is there any recommended configuration to improve this flow?

  • Is it better practice to use fingerprint only for screen unlock, not initial login?

  • Are there plans to better integrate fingerprint auth with session startup and KWallet?

I’m not sure if this is a limitation, a design decision, or something I can configure better.
Any insight from KDE devs or advanced users would be appreciated.

Thanks!

2

How did you get login with fingerprint working? I just switched from sddm and was disappointed that I couldn’t sign in with my fingerprint reader. I took a look at the repository and there it says that I can find default in /usr/lib/plasmalogin/defaults.conf but that file or folder doesn’t exists for me.

3

After some more tests, my fingerprint works on screenlock, sudo, and other requests in KDE but not on first boot login. I guess this is OK for now.

I’ll let here the steps I used to make it work:

  1. Install fprintd and libfprint that suports your device.
  2. Register the fingerprint with fprintd-enroll
  3. Verify if is recognizes your fingerprint with fprintd-verify
  4. Edit /etc/pam.d/sudo with:
    #%PAM-1.0
auth        sufficient  pam_fprintd.so  timeout=8
auth        include     system-auth
account     include     system-auth
session     include     system-auth
  5. Edit (in my case I had to create the file) /etc/pam.d/polkit-1 with:
    #%PAM-1.0
auth        sufficient  pam_fprintd.so  timeout=8
auth        required    pam_unix.so     try_first_pass
account     required    pam_unix.so
session     include     system-auth

DONE, you can test it without rebooting using sudo ls in a new terminal

4

Your experience makes sense to me. Factually, KWallet only unlocks successfully using a display manager if

  • the wallet name is kdewallet and
  • the password of the wallet matches your account password

Source (archlinux.org)

These restrictions have a very specific reason:

Behind the scenes, the password is passed to PAM for validation and during that, a hook is executed which grabs the password and tries to unlock the wallet with it. If you are using fingerprint unlock, there is no password to grab and no way to “know” how to unlock the wallet. So your understandings are correct: Since KWallet relies on unlocking with a password, unless that changes, it won’t be unlockable with a fingerprint.

For subsequent logins using Plasma’s lockscreen, I think locking / unlocking depends on your setup, meaning what you have setup here:

image
image694×897 88.9 KB

With my setup, the wallet stays open, unless the session ends. Which means, subsequent lock/unlock cycles don’t need to open the wallet because it was never closed. I think, if you enable “when screensaver starts”, your wallet would stay closed when you dismiss the lockscreen with fingerprint.

5

For me (Arch) it was located at /usr/lib/pam.d/plasmalogin

6

@fcrespo82 @Delivator @poljpocket

I just got it working for Plasma Login Manager. Happy to share the steps if you guys still need help figuring this out.

7

Yes please. Share your config so we can test it too. Thanks!

8

Once you’ve got the driver installed and you’ve added your fingerprint via System Settings, you just need to add one line to /etc/pam.d/plasmalogin:

# SPDX-License-Identifier: CC0-1.0
# SPDX-FileCopyrightText: none

auth        sufficient  pam_fprintd.so <— ADD THIS LINE
auth        include     system-login
-auth       optional    pam_gnome_keyring.so

I presume most people trying to do this have gotten this far. The reason it may not be working for you is that you have to first press enter with the password prompt empty, then you place your fingerprint on the sensor. Should work no problem.

9

I can confirm the same underlying issue on a fresh Fedora 44 setup with PLM.

System info:

  • Lenovo Thinkpad X13 Yoga Gen 1
  • Fedora 44 (KDE Plasma variant)
  • plasma-login-manager-6.7.4-1.fc44.x86_64
  • Fingerprint reader: Synaptics Sensors, via fprintd-1.94.5 + fprintd-pam
  • /etc/pam.d/plasmalogin configured with auth sufficient pam_fprintd.so on top of the standard system-auth include (via authselect with with-fingerprint feature enabled)

What I’m seeing:

Authentication itself works correctly — pressing Enter on the empty password field triggers the fingerprint scan, and a valid scan logs in successfully. However, there’s zero visual feedback while the scan is pending. The screen just looks frozen/unresponsive from the user’s perspective, until the system unlocks and the desktop is shown.

Checking journalctl -u plasmalogin -f during the process shows that the message does actually reach plasmalogin:

plasmalogin[1002]: Authentication information: PLASMALOGIN::Auth::INFO_UNKNOWN "Place your right index finger on the fingerprint reader"

So the PAM message (“Place your right index finger on the fingerprint reader”) is received by the daemon, but it’s tagged as INFO_UNKNOWN rather than a specific/handled info type, and the greeter theme apparently doesn’t render anything for that category — so the message never reaches the UI. This looks consistent with the same INFO_UNKNOWN behavior historically seen in SDDM (see sddm/sddm#1840), just carried over into PLM.

Happy to provide more logs or test a patch if useful — this seems like it could be a relatively contained fix (either categorizing this PAM message type properly on the greeter side, or having the QML theme handle INFO_UNKNOWN messages generically by displaying the message text).
P.S. When waking from sleep, the prompt for the fingerprint is shown correctly, the problem occurs only in cold boot. Also, I want to add that the lack of a visual feedback occurs even when the fingerprint read doesn’t unlock the system, generating confusion.

With that said, I just wanna thank you for the wonderful work you’re doing, you have all my appreciation for that.

10

Nathaniel, I’ve got two KDE installations with plasma-login-manager, one on Arch, one on CachyOS and /etc/pam.d/plasmalogin does not exist. In order to have fingerprint working, I had to modify system-auth and system-local-login (if interested to read: Help needed regarding fingerprint login - #2 by nite_route - Issues & Assistance - CachyOS Forum ).

So where did you get this plasmalogin file from?

Is it the only file under /etc/pam.d that contains references to fprint?

11

Answering one of my own questions, there are defaults that are used under /usr/lib/pam.d for plasmalogin. I guess you copied plasmalogin from there to /etc/pam.d and then edited it there…