fedora-workstation

#332 fingerprint reader functionality is disabled in default install, is this expected?
Closed: Fixed by kalev. Opened by kalev.

Closed: Fixed
Reopen Issue

I helped @kevin debug today why the fingerprint support was completely missing in his installation. The fingerprint UI in gnome-control-center didn't show up, and gdm didn't allow fingerprint login even when manually enrolling with fprintd-enroll on the command line.

After a bit of code reading, we figured out that the gsettings key 'org.gnome.login-screen enable-fingerprint-authentication' was set to false, which in turn then disabled all of the fingerprint functionality, but trying to set it back to true ended up with a puzzling error:

21:55 < nirik> ➜  ~ gsettings set org.gnome.login-screen enable-fingerprint-authentication true
21:55 < nirik> The key is not writable

It turned out that new Workstation installs have a dconf override that disables fingerprint support and disallows anyone from changing the setting to re-enable it.

From Workstation install media:

[liveuser@localhost-live ~]$ cat /etc/dconf/db/distro.d/20-authselect
# Generated by authselect on Tue Sep  6 18:29:21 2022
# Do not modify this file manually, use authselect instead. Any user changes will be overwritten.
# You can stop authselect from managing your configuration by calling 'authselect opt-out'.
# See authselect(8) for more details.
[org/gnome/login-screen]
enable-smartcard-authentication=false
enable-fingerprint-authentication=false
enable-password-authentication=true
[liveuser@localhost-live ~]$ cat /etc/dconf/db/distro.d/locks/20-authselect 
# Generated by authselect on Tue Sep  6 18:29:21 2022
# Do not modify this file manually, use authselect instead. Any user changes will be overwritten.
# You can stop authselect from managing your configuration by calling 'authselect opt-out'.
# See authselect(8) for more details.
/org/gnome/login-screen/enable-smartcard-authentication
/org/gnome/login-screen/enable-fingerprint-authentication
/org/gnome/login-screen/enable-password-authentication

Is this expected that it's disabled like this in a clean install? Apparently there's a tool called authselect that is installed by default and disables GNOME functionality?

$ authselect current
Profile ID: sssd
Enabled features:
- with-silent-lastlog
- with-mdns4

Looks like the authselect 'sssd' profile disables fingerprint support.

This is definitely not expected. :frowning:

Hey @pbrezina, could you make sure fingerprint and smartcard are enabled by default, please?

Why would you enable smartcard by default? AFAIK it was never enabled by default and It requires extra configuration that has no tool support in Gnome?

Fingerprint is automatically enabled by anaconda installation if fprintd is installed. So unless you use kickstart, fingerprint should be enabled. It is not automatically enabled by authselect as it requires pam_fprintd to be installed.

https://github.com/rhinstaller/anaconda/blob/master/pyanaconda/modules/security/installation.py#L406

Oh, indeed: I just checked a clean Workstation install and fingerprint nicely got enabled there. It was disabled on the live media (as I noted in my original post) but then got enabled in the final resulting install.

Looks like I may have made noise when it's actually working as intended. :) Sorry!

@kevin How did you do the install where you ended up with no fingerprint support?

Huh. I just used a rawhide live workstation. ;(

It was from Fedora-Rawhide-20220827.n.0

I do see in the logs:

dbus.log:DEBUG:anaconda.modules.security.installation:Fingerprint configuration is not enabled. Skipping.

I'm really not sure why it would not have enabled it. I don't see any errors, and fprintd was definitely installed. ;(

So, can we close this issue...?

Yes, let's close this.

Metadata Update from @kalev:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/workstation/tickets/issues/332

Please continue any further discussion there.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.