Have to scan fingerprint after entering password

[erazemk]

Swaylock version: 1.3
OS: Arch Linux
Sway version: 1.0
Laptop: Thinkpad T540p

If I lock the screen with swaylock I have to enter the password (obviously), but after entering the correct password, it will not let me in. This is when my fingerprint reader starts showing its "scanning" light. It only lets me in when I scan my fingerprint.

The scanner doesn't start until I enter something (Not necessarily my actual password - can even press Enter) and doesn't work even if entering right password (until I scan my fingerprint).

It appears that the fingerprint scanner doesn't start automatically until a key press triggers the login process.

[rsansores]

I'm not sure if this is a bug. What is happening is that PAM is launched when you press "Return" key. Your PAM must be configurated to first request fingerprint so even if you write your password PAM will ignore the input and wait for the fingerprint.

In a GDM this is not an issue because there are two steps.

Step 1: request the user to login
Step 2: request password

After step 1 PAM is called. But in the end, sway-lock is not a GDM, is just a tool to lock a wayland session.

As workaround you could:

• Configure PAM to not request fingerprint for swaylock.

or

• Unlock without password. Just press enter to unlock and put your finger in the fingerprint reader.

or

• Fork sway lock to add some functionality to make the election of fingerprint or password depending on the /etc/pam.d/swaylock pam configuration.

Fork sway lock to add some functionality to make the election of fingerprint or password depending on the /etc/pam.d/swaylock pam configuration.

I'm facing the same behavior as the one described in this issue, and I'd like to try to implement this feature.
I imagine a flag like --early-pam or something like that, that would trigger the verification right away. Would this be an interesting feature to merge on swaylock once implemented ?

[kcxt]

Fork sway lock to add some functionality to make the election of fingerprint or password depending on the /etc/pam.d/swaylock pam configuration.

I'm facing the same behavior as the one described in this issue, and I'd like to try to implement this feature.
I imagine a flag like --early-pam or something like that, that would trigger the verification right away. Would this be an interesting feature to merge on swaylock once implemented ?

Would be sweet if you're still thinking about it, an important note is that fprintd will (and should) timeout, so I'm not sure how feasible this is.

[ardevd]

Any news on this? I'm having a hard time with swaylock after adding fingerprint auth in Gnome.

[kcxt]

Any news on this? I'm having a hard time with swaylock after adding fingerprint auth in Gnome.

Not sure if you read the other comments, you don't have to enter your password... When you hit enter swaylock will attempt to authenticate with pam, in this case rather than sending your password, pam will call fprintd and wait for your fingerprint to auth.

So in summary, hit enter, scan finger, will unlock

Might be worth closing this issue as it doesn't seem realistic to change that behaviour, unless sway can detect your default authentication method which seems like security risk. Or implement a solution similar to GDM that lets you auth with both at any point.

[mnd999]

The current behaviour is super-unintuitive so I don’t think this issue should be closed without either making it work more intuitively or (more likely) documenting it with a howto or similar.

[andrino-meli]

Maybee You are interested how to do the workaround mentioned by @rsansores.

• Unlock without password. Just press enter to unlock and put Your finger in the fingerprint reader.

So here an elaboration:

According to https://wiki.archlinux.org/title/Fprint having these 2 lines at the very top of /etc/pam.d/swaylock

auth            sufficient      pam_unix.so try_first_pass likeauth nullok
auth            sufficient      pam_fprintd.so
...

will still allow You to authenticate with a password as usuall. However additionally if You provide a blank, so just by pressing enter with no prior input, it will switch to finger print authentication. However make sure that You allow blank input in the swaylock configuration for this to work. Namely delete (or comment out) ignore-empty-password in ~/.config/swaylock/config if it is present.

Hope this helps someone.

[anpandey]

Fork sway lock to add some functionality to make the election of fingerprint or password depending on the /etc/pam.d/swaylock pam configuration.

I'm facing the same behavior as the one described in this issue, and I'd like to try to implement this feature.
I imagine a flag like --early-pam or something like that, that would trigger the verification right away. Would this be an interesting feature to merge on swaylock once implemented ?

Would be sweet if you're still thinking about it, an important note is that fprintd will (and should) timeout, so I'm not sure how feasible this is.

Another potential issue worth considering is when swaylock is used with swayidle's before-sleep. On my machine at least, PAM fails after a sleep when waiting for a fingerprint because the fingerprint module is powered off. You could just use after-resume, but then there's the issue of the desktop being briefly visible after waking up but before swaylock starts.

A workaround might be to have a separate command-line program that just spawns a layer-shell to cover the desktop before sleep, and spawns a swaylock process on any sort of activity (so we only start swaylock after resume).

[Moelf]

using https://frame.work with Sway on arch and I was so confused...

any update / pointer to where to implement this?

[miXwui]

@Moelf I'm using Sway on Fedora on a Framework laptop as well.

It's been about half a year without issue using @andrino-meli's comment above with @rsansores's workaround:
#61 (comment)

Note that with some applications like Swaylock, you may need to first press enter to submit a blank password, then swipe your finger.

[Moelf]

Yeah that works for me too, I guess this issue can be closed ?

[kcxt]

I've also been dealing with this workaround for quite some time. I think swaylock should have some logic to detect an active fingerprint reader and - for example - give some kind of "press enter to scan finger" message, as well as skipping the aforementioned foot-guns (ignore-empty-password).

imo the behaviour as it stands doesn't make for good UX and should be improved upon to justify actually closing this issue, if it's closed as is I would expect new similar issues to be opened as people no longer find this one.

it's been 3 years, and swaylock still doesn't support FP readers properly /shrug

[mnd999]

Apple do this well, it should work like that.