AAD local password incompatible with fingerprint reader auth?

[pablo-kim]

Hello, I got AAD authd broker working and users login into the systems creating a local password.

Seems that AAD users cannot use or set up fingerprint authentication even if it's on the PAM config. This tested on a non AAD user works and they can set up fingerprint authentication.
Is AAD local passwords incompatible with fprintd? Or is there some configuration that I am missing?

/etc/pam.d/common-auth

# here are the per-package modules (the "Primary" block)
auth    [success=4 ignore=ignore default=die authinfo_unavail=ignore]   pam_authd_exec.so /usr/libexec/authd-pam
auth    [success=3 default=ignore]      pam_fprintd.so max-tries=1 timeout=10 # debug
auth    [success=2 default=ignore]      pam_unix.so nullok try_first_pass
auth    [success=1 default=ignore]      pam_sss.so use_first_pass

``

[3v1n0]

In order to get it working you need to give the fingerprint authentication some higher priority so that it gets added before of authd.

Maybe we should consider having authd a lower priority so that it doesn't override pam_fprintd.so

[3v1n0]

It's worth mentioning that changing common-auth will only affect command line utilities though, while on GDM side the fingerprint should work already, even if with some UI limitations (see #709)