Gdm3 with smartcard asks for login/smartcard pin even if there is no smartcard authentication enabled
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
gdm3 (Ubuntu) |
Confirmed
|
Undecided
|
Unassigned | ||
gnome-shell (Ubuntu) |
Confirmed
|
Undecided
|
Unassigned |
Bug Description
I use my Ubuntu PC with Yubikey almost always plugged in. It provides several security token interfaces, such as U2F, GPG smartcard, proprieritary Yubico interfaces (of which I mostly use TOTP codes), and also PIV smartcard. However, I haven't configured a PIV smartcard on it.
Whenever I login into the system having Yubikey plugged in, I'm prompted for login name, and then for PIN for some smartcard while also being asked to plug in one. This is very misleading on several layers:
1. I have the device providing smartcard plugged id,
2. But it's not the smartcard GDM would think it is as it's not configured properly,
3. There are no local smartcard-
3. There are no remote authentication systems configured on the system (so no ActiveDirectory
If I unplug the token UX goes back on old good track.
Given the circumstances above, I'd consider that GDM (and, on my bet, any PAM configuration it uses) shouldn't offer to login using smartcard if there is no way to actually do so. I feel something is off here, so I'm reporting a bug. It could be an upstream problem though; it also could be an upstream SSSD problem, or all combined.
I believe there is a more clear user experience:
1. GDM should display users that can login into the system, as it always does (if configured). It may also provide entering other login name (also if configured). This is GDM usually does without smartcards altogether.
2. When user is chosen (from the list or manually typed in), check can this user even authenticate with smartcards (i.e. if any of available smartcards is actually recognised for this user). If so, then ask for PIN. Else, don't show anything about smartcards at all (this includes when SSSD is not configured for any AD or related and this user has no local smartcard configuration). This can switch there & back based on device events.
I've seen other OS doing this.
Ubuntu/Gnome session doesn't ask me for PIN for a smartcard on a lock screen, so I guess it doesn't support it at all or correctly finds out it can't be used. Even more, I couldn't find a way to actually add my smartcard as a local login method.
ProblemType: Bug
DistroRelease: Ubuntu 21.04
Package: gdm3 3.38.2.1-2ubuntu1
ProcVersionSign
Uname: Linux 5.11.0-18-generic x86_64
NonfreeKernelMo
ApportVersion: 2.20.11-0ubuntu65.1
Architecture: amd64
CasperMD5CheckR
CurrentDesktop: ubuntu:GNOME
Date: Sun Jun 20 14:02:02 2021
InstallationDate: Installed on 2017-03-05 (1567 days ago)
InstallationMedia: Ubuntu 16.04 LTS "Xenial Xerus" - Release amd64 (20160420.1)
ProcEnviron:
TERM=tmux-256color
PATH=(custom, no user)
XDG_RUNTIME_
LANG=ru_RU.UTF-8
SHELL=/bin/bash
SourcePackage: gdm3
UpgradeStatus: Upgraded to hirsute on 2021-05-13 (37 days ago)
tags: | added: jammy |
tags: | removed: hirsute |
Changed in gnome-shell (Ubuntu): | |
status: | Confirmed → Fix Released |
Changed in gnome-shell (Ubuntu): | |
status: | Fix Released → Confirmed |
tags: | added: mantic |
Assigning to gnome-shell (which implements the login GUI).