Unity Greeter - Custom change password prompts

[Robert Ancell]

The greeter needs to support complex authentication requests from the system. The current implementation has a text line between the username and the password box, but this can only support a small amount of text.

The authentication process prompts the greeter with:
- One or more "messages" to display (could be multiple lines)
- One or more errors to display (could be multiple lines)
- One or more prompts to display (with the input set to show or hide)

In a traditional text login these messages / are displayed on the screen and appended to the existing text, e.g.
login: bob
password: *******
You need to change your password, please enter a new one
The password must be more than 5 characters and contain a mix of letters and numbers
new password: ****

[Robert Ancell (robert-ancell)]

The messages and prompts are completely system defined and the greeter cannot tell what sort of message they are except by checking the text that they have (e.g. we match "password:" to be a password prompt).

Some suggestions of messages that may be displayed:
- Error message if the account is locked (authentication fails)
- Prompt to change password after logging in (see bug description for example)
- Prompt to enter an RSA key number (prompt input is not hidden like a password)
- Display a disclaimer that needs to be acnowledged to allow login

[Mika Meskanen (mika)]

I looked into this by wireframing a Change Password type of a user journey.

Please have a look at the attached PDF – if you open it in a proper viewer you should also be able to go through it by clicking on the hotlinked buttons (Continue, Back etc.)

I'm optimistic that this pattern can solve a number of complex authentication use cases – so please feel free to throw nukes at it and push any requirements this way…

[Robert Ancell (robert-ancell)]

Ooh, that's really slick! I also like the logging in spinner, as it felt like we were missing something to do once authentication was complete.

[Mika Meskanen (mika)]

Good good!
Here's Rosie's visuals to accompany the piece…

[Robert Ancell (robert-ancell)]

So, I think the logic is, if Unity Greeter interprets a prompt from PAM as a username or password entry it displays those as it does currently. If any other prompt is detected, it uses a "continue" button, then slides to the "complex authentication dialog" which can ask those questions / show prompts.

[Michael Terry (mterry)]

FYI, to force the system to prompt for your password for testing, run the following (changing the "User1000" as appropriate):

dbus-send --print-reply --system --dest=org.freedesktop.Accounts /org/freedesktop/Accounts/User1000 org.freedesktop.Accounts.User.SetPasswordMode int32:1

[Michael Terry (mterry)]

Mika, at least in the change-password use case, I don't believe the login system will tell us upfront whether the user will have to change their password.

Rather, it will wait until the user tries to log in. So how terrible would it be if the workflow changed from

Continue Button -> (slide in) -> Current Password -> New Password -> Confirm -> Success

to

Current Password -> (slide in) -> New Password -> Confirm -> Success

?

[Michael Terry (mterry)]

Right now, lightdm doesn't even handle changing the password correctly. It errors out about authentication issues. I filed bug 911597 and branch https://code.launchpad.net/~mterry/lightdm/pam-tty/+merge/87432 about it.

I'll leave this bug about the presentation in unity-greeter.

[Lars Düsing (lars.duesing)]

There is another problem linked with this - too few space for complex PAM-dialogs: See LP: #968855

[Robert Ancell (robert-ancell)]

I've opened bug 1043593 to track the multiple prompt part of this bug.

[Michael Terry (mterry)]

Marking Won't Fix for raring, as I likely won't be able to get to this (getting this off my status radar). If someone else wants to pick it up, be my guest and re-open! Otherwise, hopefully we can get to it in S.