Make i3lock support PAM prompts (better support for PAM messages and passwordless PAM methods like fingerprint-gui)

[pstray]

I'm submitting a…

[ ] Bug
[x] Feature Request
[ ] Other (Please describe in detail)

Current Behavior

Currently you need to submit a password to trigger any PAM method, so just fingerprint won't work. For some reason I actually need to supply both a valid password and fingerprint when fingerprint-gui is enabled.

Expected Behavior

Unlock with just fingerprint, or just password.

Environment

Output of i3lock --version:

i3lock version:  2.10 (2017-11-25)

[Airblader]

This is largely a duplicate of i3/i3#852. The question there still stands: we need some way to know when a fingerprint has been scanned to trigger pam.

[pstray]

Well... I guess you have to trigger PAM to make it read a fingerprint and check it. Not sure how other screensavers (like gnome) does this, but they seem to managet to do it.

[Airblader]

I would expect the workflow to go the other way and the sensor to be always ready and somehow informing the kernel of the read, which pam hooks into. We certainly don't want to do this ourselves, so we'd need some connection through pam.

But however it works, if someone can investigate and report back it would help making a decision here.

[webknjaz]

This is largely a duplicate of #852.

@Airblader that's a typo. Which one did you mean?

[camparijet]

This is largely a duplicate of #852.

@Airblader that's a typo. Which one did you mean?

@webknjaz I believe he meant i3/i3#852

[Airblader]

Yes, correct issue number, wrong repository. Sorry :-)

[webknjaz]

@Airblader it probably makes sense to edit the original comment ;)

[webknjaz]

Oh, and does it have to rely on i3 itself? I'm using just i3lock without i3, for example...

[Airblader]

No, the issue over at i3 is just so old that it predates Github. This is the correct repository.

[webknjaz]

The suggestion is that #852 now points to nowhere but once there's a new issue with this number in this repo it will point there and be totally misleading.
If you replace it with i3/i3#852 in this comment #217 (comment) GitHub will create correct links and backreference from there.

[Airblader]

Yes, I was gonna update the comment, I just didn't wanna do it from mobile. Willdo now, thanks ;-)

[andreesteve]

Reading around seems that one way to do it (at least the way I understood it from reading this proposal in GDM) is to start multiple PAM calls in parallel using different service names (e.g. i3lock, i3lock_1, i3lock_2, etc) where the system admin could configure independent auth flows (password, fingerprint, smartcard, etc) and the application would accept any of these flows to successfully authenticate the user.

[evamvid]

This is the way fprintd seems to expect it to be done as well:

https://github.com/freedesktop/libfprint-fprintd/tree/master/pam

pam_fprintd doesn't support entering either the password or a fingerprint, as pam_thinkfinger does, because it's a gross hack, and could be fixed by having the login managers run 2 separate PAM stacks