Support parallel password and fingerprint authentication

Kirill Sokolovrequested to merge
pasternak/plasma-login-manager:feature/parallel-fingerprint-upstream into master

Summary

Add support for running password and fingerprint authentication in parallel during interactive login.

Currently, password and fingerprint authentication cannot operate as independent authentication methods. This makes it impossible to retry a failed password while fingerprint authentication remains active, and couples both methods to the same PAM conversation.

This change introduces separate authentication processes for password and fingerprint authentication. The first method to succeed starts the session, while the other authentication process is terminated.

Implementation

  • Allow the authentication helper to use a selected PAM service.
  • Add a dedicated authentication coordinator for interactive login.
  • Run password and fingerprint authentication through separate helpers.
  • Start fingerprint authentication as soon as a user and session are selected.
  • Defer session startup until the coordinator chooses the successful method.
  • Keep fingerprint authentication active after an incorrect password.
  • Restart only the password helper when the user retries the password.
  • Continue using the existing authentication path for autologin.
  • Fall back to password-only authentication when the fingerprint PAM service is not installed.
  • Add and install a dedicated plasmalogin-fingerprint PAM service.

Behaviour

Password and fingerprint authentication run independently.

The first successful authentication method wins and starts the session. The other helper is stopped.

An incorrect password does not stop fingerprint authentication. The user can enter another password while the fingerprint helper remains active.

If the dedicated fingerprint PAM service is unavailable, interactive login uses the existing password-only authentication path.

Testing

Tested manually on Plasma 6.7.3:

  • Successful password authentication.
  • Successful fingerprint authentication.
  • Incorrect password followed by a successful password retry.
  • Incorrect password followed by successful fingerprint authentication.
  • Password and fingerprint race conditions with either method winning.
  • Password retry while fingerprint authentication remains active.
  • Password-only fallback when the fingerprint PAM service is unavailable.

Tested against the current master branch:

  • Full project compilation completed successfully.
  • Staging installation with DESTDIR completed successfully.
  • The plasmalogin-fingerprint PAM service was installed into the PAM configuration directory.
  • All automated tests passed: 2/2.

The commits are separated into logical implementation steps. Please review them individually and do not squash them when merging.

Merge request reports