A proposal to improve the Plasma Login Manager regarding fingerprint authentication.
As a user of Manjaro Linux (Arch Linux) and KDE Plasma, I have successfully configured fingerprint recognition but see room for improvement.
I therefore suggest that David Edmundson, the developer of the Plasma Login Manager, should collaborate with Bastien Nocera, the developer of fprintd, to find an optimal solution.
The following packages are currently installed on my laptop (which has a fingerprint sensor):
plasma-login-manager 6.7.4-1
fprintd 1.94.5-2
libfprint 1.94.100-1
kscreenlocker 6.7.4-1
I can log in to the KDE desktop using either a fingerprint or a password. I also use fingerprint authentication for the KDE screen lock. A benefit of the screen lock is that it displays a notice text indicating that fingerprint login is available.
Following the Arch Linux Wiki, I modified two files in /etc/pam.d (originally from /usr/lib/pam.d): plasmalogin (part of the plasma-login-manager package) and kde-fingerprint (part of the kscreenlocker package); see my modifications below.
The screen lock differs from the Plasma login process in two ways: first, the fingerprint is requested in a continuous loop - requiring me to set the pam_fprintd.so parameter timeout=-1 so that fingerprint recognition doesn’t time out during long breaks; second, a notice text is displayed as long as the fprintd integration is active.
In contrast, the Plasma login screen displays no such notice, and to use the fingerprint, one must first press the Return key in the empty password field.
Proposal:
Could the Plasma Login Manager display a notice text for the selected user account if a fingerprint is registered for it? Bastien Nocera, the fprint developer, is likely the best person to judge whether simply checking for the existence of the /var/lib/fprint/[username] directory is sufficient.
If the selected user account is eligible for fingerprint recognition, a notice could be displayed indicating that the Return key needs to be pressed in the empty password field before the fingerprint scan.
Alternatively, could the system perhaps offer switching (or toggling) to fingerprint recognition via an on-screen button, without requiring the Return key to be pressed first?
For the time being, I am content with these settings::
My /etc/pam.d/plasmalogin:
#%PAM-1.0
# SPDX-License-Identifier: CC0-1.0
# SPDX-FileCopyrightText: none
# Locally set by admin for fingerprint recognition:
auth sufficient pam_unix.so try_first_pass
auth sufficient pam_fprintd.so timeout=2
# proposed parameters from arch wiki not used on this computer:# likeauth nullok
# likeauth is obsolete and nullok is only needed for passwordless users
# Default contents from /usr/lib/pam.d/plasmalogin:
auth include system-login
-auth optional pam_gnome_keyring.so
-auth optional pam_kwallet5.so
account include system-login
password include system-login
-password optional pam_gnome_keyring.so use_authtok
session optional pam_keyinit.so force revoke
session include system-login
-session optional pam_gnome_keyring.so auto_start
-session optional pam_kwallet5.so auto_start
My /etc/pam.d/kde-fingerprint:
#%PAM-1.0
auth required pam_shells.so
auth requisite pam_nologin.so
auth requisite pam_faillock.so preauth
-auth required pam_fprintd.so max-tries=10 timeout=-1
# max-tries and negative timeout set by admin
auth optional pam_permit.so
auth required pam_env.so
account include system-local-login
password required pam_deny.so
session include system-local-login