https://bugs.kde.org/show_bug.cgi?id=527454
Bug ID: 527454
Summary: Fingerprint-unlock hint text/indicator missing from
lock screen UI in Plasma 6.8, despite fingerprint
authentication (fprintd) working correctly
Classification: Plasma
Product: plasmashell
Version First 6.8.0
Reported In:
Platform: CachyOS
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: Screen locking
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: 1.0
I noticed the lock-screen no longer showing the suggestion to scan fingerprint
(which was appearing prior to 6.8 update). I asked Claude to take a look so it
guided me through some (hopefully) pragmatic testing. The following report was
generated by Claude as a result of that testing by myself (a genuine human
being) observing whether the suggestions actually would re-enable the text
suggestion.
Software Versions:
- kscreenlocker: 6.8.0-1.1
- plasma-workspace: 6.8.0-1.1
- plasma-desktop: 6.8.0-1.1
- fprintd: 1.94.5-2.1
- Distribution: CachyOS
- Desktop: KDE Plasma 6.8, Wayland
- Global theme: org.kde.breezedark.desktop (no lockscreen override; falls
back to default org.kde.plasma.desktop shell lockscreen package)
Summary of behavior:
Prior to 6.8, the lock screen showed explanatory text below the password
field ("(or scan your fingerprint on the reader)") when fingerprint auth was
available. In 6.8, this text no longer appears, even though fingerprint unlock
still works. There is also no fallback indicator — the new multi-authenticator
button row (introduced in 6.8) that should appear when more than one auth
method is detected never appears either.
Steps to reproduce:
1. Have a fingerprint enrolled via fprintd/System Settings > Users, with
pam_fprintd.so wired into kde-fingerprint PAM service (standard Arch/CachyOS
packaging — verified correct, see below).
2. Lock the screen (Meta+L or auto-lock).
3. Observe the password field — no fingerprint hint text appears below it.
4. Scan an enrolled finger — authentication succeeds and the session unlocks
normally.
Expected behavior:
The hint text "(or scan your fingerprint on the reader)" should appear below
the password field as soon as kscreenlocker_greet detects a fingerprint-capable
authenticator is available for the user, per the existing code in
MainBlock.qml:
FailableLabel {
kind: ScreenLocker.Authenticator.Fingerprint
label: i18ndc(..., "(or scan your fingerprint on the reader)")
}
(visible: authenticator.authenticatorTypes & kind)
Actual behavior:
The label never becomes visible. Additionally, the newer
authenticationTypeItem button row in LockScreenUi.qml (visible only when
authenticationTypeRepeater.count > 1, backed by
ScreenLocker.AuthenticatorModel) also never appears — meaning neither the
legacy detection flag nor the new 6.8 multi-authenticator UI registers
fingerprint as an available method, even though it is fully functional
underneath.
Investigation performed (ruling out other causes):
1. PAM configuration confirmed correct — /usr/lib/pam.d/kde-fingerprint has the
expected optional pam_fprintd.so line:
-auth required pam_fprintd.so
2. fprintd confirmed functional end-to-end — journal shows fprintd being
D-Bus-activated, capturing, and identifying successfully on every lock/unlock
cycle:
systemd[1]: Started Fingerprint Authentication Daemon.
fprintd[...]: Capture Initiated, Please place your finger now on the sensor
now
fprintd[...]: cv_fingerprint_identify failed 89 (normal no-match-yet retry)
fprintd[...]: Capture Initiated, Please place your finger now on the sensor
now
systemd[1]: fprintd.service: Deactivated successfully.
3. Ruled out a cold-start/D-Bus-activation race — fprintd.service is static
(on-demand, D-Bus-activated, auto-idles). Manually pre-warmed it (sudo
systemctl start fprintd.service) ~11 seconds before locking, confirmed via
journal timestamps it was already active (running) when kscreenlocker_greet
launched. The hint still did not appear — so this is not a timing race between
greeter startup and fprintd activation.
4. Ruled out a config toggle —
/usr/share/config.kcfg/kscreenlockersettings.kcfg contains no
fingerprint-related entry at all (only Autolock, Timeout, RequirePassword,
LockOnResume, LockOnStart, and WallpaperPlugin under [Greeter]). There is
nothing to toggle back on; detection is purely runtime.
5. Confirmed both UI detection paths fail identically — the legacy
FailableLabel hint and the new 6.8 authenticator-switcher button row both fail
to indicate fingerprint availability, despite fprintd working. This points to a
single shared root cause in whatever back-end call is meant to populate
authenticator.authenticatorTypes / feed ScreenLocker.AuthenticatorModel, rather
than two independent UI bugs.
Suspected cause: Something in the 6.8 refactor of the lock screen's
multi-authenticator support (new AuthenticatorModel/PamAuthenticators plumbing,
per LockScreenUi.qml header crediting Kristen McWilliam, 2026) appears to have
broken or orphaned the logic that previously populated
authenticator.authenticatorTypes with the Fingerprint bit — independent of
PAM/fprintd actually functioning.
Impact: Cosmetic/discoverability only — fingerprint unlock itself is
unaffected and continues to work. However, new users or anyone who forgets
fingerprint is set up get no on-screen indication that it's available, and the
new 6.8 multi-method UI (that should let you see/select auth methods) doesn't
render for fingerprint users at all.
--
You are receiving this mail because:
You are watching all bug changes.
