Please improve Plasma Login Manager for fingerprint login

A proposal to improve the Plasma Login Manager regarding fingerprint authentication.

As a user of Manjaro Linux (Arch Linux) and KDE Plasma, I have successfully configured fingerprint recognition but see room for improvement.

I therefore suggest that David Edmundson, the developer of the Plasma Login Manager, should collaborate with Bastien Nocera, the developer of fprintd, to find an optimal solution.

The following packages are currently installed on my laptop (which has a fingerprint sensor):

plasma-login-manager 6.7.4-1
fprintd 1.94.5-2
libfprint 1.94.100-1
kscreenlocker 6.7.4-1

I can log in to the KDE desktop using either a fingerprint or a password. I also use fingerprint authentication for the KDE screen lock. A benefit of the screen lock is that it displays a notice text indicating that fingerprint login is available.

Following the Arch Linux Wiki, I modified two files in /etc/pam.d (originally from /usr/lib/pam.d): plasmalogin (part of the plasma-login-manager package) and kde-fingerprint (part of the kscreenlocker package); see my modifications below.

The screen lock differs from the Plasma login process in two ways: first, the fingerprint is requested in a continuous loop - requiring me to set the pam_fprintd.so parameter timeout=-1 so that fingerprint recognition doesn’t time out during long breaks; second, a notice text is displayed as long as the fprintd integration is active.

In contrast, the Plasma login screen displays no such notice, and to use the fingerprint, one must first press the Return key in the empty password field.

Proposal:

Could the Plasma Login Manager display a notice text for the selected user account if a fingerprint is registered for it? Bastien Nocera, the fprint developer, is likely the best person to judge whether simply checking for the existence of the /var/lib/fprint/[username] directory is sufficient.

If the selected user account is eligible for fingerprint recognition, a notice could be displayed indicating that the Return key needs to be pressed in the empty password field before the fingerprint scan.

Alternatively, could the system perhaps offer switching (or toggling) to fingerprint recognition via an on-screen button, without requiring the Return key to be pressed first?

For the time being, I am content with these settings::

My /etc/pam.d/plasmalogin:

#%PAM-1.0

# SPDX-License-Identifier: CC0-1.0
# SPDX-FileCopyrightText: none

# Locally set by admin for fingerprint recognition:

auth      sufficient    pam_unix.so try_first_pass
auth      sufficient    pam_fprintd.so timeout=2
#   proposed parameters from arch wiki not used on this computer:# likeauth nullok
#   likeauth is obsolete and nullok is only needed for passwordless users

# Default contents from /usr/lib/pam.d/plasmalogin:

auth        include     system-login
-auth       optional    pam_gnome_keyring.so
-auth       optional    pam_kwallet5.so

account     include     system-login

password    include     system-login
-password   optional    pam_gnome_keyring.so    use_authtok

session     optional    pam_keyinit.so          force revoke
session     include     system-login
-session    optional    pam_gnome_keyring.so    auto_start
-session    optional    pam_kwallet5.so         auto_start

My /etc/pam.d/kde-fingerprint:

#%PAM-1.0

auth       required                    pam_shells.so
auth       requisite                   pam_nologin.so
auth       requisite                   pam_faillock.so      preauth
-auth      required                    pam_fprintd.so   max-tries=10 timeout=-1
#   max-tries and negative timeout set by admin

auth       optional                    pam_permit.so
auth       required                    pam_env.so

account    include                     system-local-login

password   required                    pam_deny.so

session    include                     system-local-login

I think it might get improved with the ongoing work towards multiple types authentication flow, see This Week in Plasma: UI and Performance Improvements - KDE Blogs, maybe @sitter has more insight on this.

IIRC, the timeout by default exists because it’s keeping the sensor on, and depending on sensor type the hardware might timeout itself and shutdown to prevent overheating or other issues.

Correct.

I have a prototype already where plasma login manager has the same authentication selectors as the lockscreen prototype has. We have some refactoring to do before we can land that though. The ultimate goal is to have all our authentication prompts behave the same, with the same feature set.

Regarding timeouts: this also brings improvements because our UIs have an idle state during which we can suspend the sensor. Setting timeout=-1 appears to largely be snakeoil btw, fprintd will still suspend the device eventually to prevent overheating.