pam: flexible authenticator support

Harald Sitterrequested to merge
work/sitter/multiprompt into master

rework the internals of the pam support to facilitiate more flexible backends. this should be backwards compatible for the time being as only internals change.

it's largely straight forward. instead of having an interactive / noninteractive split we now have an active / fingerprint split (for the purposes of public PamAuthenticators API they map 1:1). both new types are mutable which allows us to switch between different active configurations (pam, face, u2f, smartcard ...) or disable the fingerprint entirely.

the way this works from a UX perspective is that the user can select the type of authentication they want to use and then we'll switch the relevant authenticator in as active. this means the new authenticator takes over the prompting and stuff, allowing us to very flexibly add more type configuration even when they require prompting because we only ever have one active type. this gets augmented by the fingerprint handling which may be active on any number of types as secondary log in option. this is for convenience more than anything.

because we now switch authenticators at will that means we also need them to cancel! pam_fprint has basic support for this by handling SIGINT. we double down on this by actively sending SIGINT when cancelling an authenticator.

to assist with visualizing this a new PAMAuthenticatorModel is being introduced which describes the available authenticators for visualization

Requirements

Testing

Create ~/.config/kscreenlockerrc with

[Authenticators]
Smartcard=true
Fingerprint=true
Face=true
Universal2Factor=true

Copy /etc/pam.d/kde-smartcard to kde-face and kde-u2f

Replace the pam_pkcs11.so rule in kde-face with:

-auth  required  pam_howdy.so

Replace the pam_pkcs11.so rule in kde-u2f with:

-auth  required  pam_u2f.so cue

Part of kde-linux/kde-linux#665

Edited by Harald Sitter

Merge request reports