canonical / canonical/authd

GDM asks for password when broker is disabled

Open
#1,359 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
308
Forks
41
Avg merge
2d 4h
Merged PRs (30d)
58

Description

GDM asks me for a password when selecting an existing authd user when no authd brokers are configured:

Any password I enter results in "Sorry that didn't work. Please try again.", also if I enter the correct local password of that user.

I'm able to reproduce this on Noble and Resolute.

Steps to reproduce:
1. Configure a broker (I used `authd-msentraid`)
2. Authenticate with the broker
3. `sudo rm /etc/authd/brokers.d/*`
4. `sudo systemctl restart authd`
5. In GDM, select the existing authd user.

Relevant logs (from Noble):
```
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Connecting to unix:///run/authd.sock
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Sending to GDM: {"type":"hello"}
Mar 23 15:34:06 ubuntu gnome-shell[3139]: authd: Starting authd protocol
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Got from GDM: {"type":"hello","hello":{"version":1}}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Gdm Reply is type:hello hello:{version:1}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.initHealthCheck{}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Sending to GDM: {"type":"request", "request":{"type":"uiLayoutCapabilities", "uiLayoutCapabilities":{}}}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Got from GDM: {"type":"response","response":{"type":"uiLayoutCapabilities","uiLayoutCapabilities":{"supportedUiLayouts":[{"type":"form","label":"required","wait":"optional:true,false","entry":"optional:chars,chars_password,digits,digits_password"},{"type":"newpassword","label":"required","entry":"optional:chars,chars_password,digits,digits_password"},{"type":"qrcode","label":"required","button":"optional","wait":"required:true,false","content":"required","code":"optional"}]}}}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.supportedUILayoutsReceived{layouts:[]*authd.UILayout{(*authd.UILayout)(0xc0001909a0), (*authd.UILayout)(0xc000190c40), (*authd.UILayout)(0xc000190cb0)}}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.brokersListReceived{brokers:[]*authd.ABResponse_BrokerInfo{(*authd.ABResponse_BrokerInfo)(0xc000326be0)}}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.BrokerListReceived{}, brokers: []*authd.ABResponse_BrokerInfo{(*authd.ABResponse_BrokerInfo)(0xc000326be0)}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Sending to GDM: {"type":"event", "event":{"type":"brokersReceived", "brokersReceived":{"brokersInfos":[{"id":"local", "name":"local", "brandIcon":""}]}}}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.userSelected{username:"test@ubudev1.onmicrosoft.com"}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Sending to GDM: {"type":"event", "event":{"type":"userSelected", "userSelected":{"userId":"test@ubudev1.onmicrosoft.com"}}}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.UsernameSelected{}, user: "test@ubudev1.onmicrosoft.com"
Mar 23 15:34:06 ubuntu authd[2279]: Last used broker "2102147668" is not available for user "test@ubudev1.onmicrosoft.com", letting the user select a new one
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.brokerSelectionRequired{}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.ChangeStage{Stage:"brokerSelection"}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: *adapter.authModeSelectionModel: Reset
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.List: Focus
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Got from GDM: {"type":"eventAck"}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: EventSend&{brokersInfos:{id:"local" name:"local" brand_icon:""}}result
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.listFocused{id:0x1}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.StageChanged{Stage:"brokerSelection"}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Sending to GDM: {"type":"request", "request":{"type":"changeStage", "changeStage":{"stage":"brokerSelection"}}}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Got from GDM: {"type":"eventAck"}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: EventSend&{userId:"test@ubudev1.onmicrosoft.com"}result
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Got from GDM: {"type":"response","response":{"type":"changeStage","ack":{}}}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Gdm stage change to brokerSelection sent
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Got from GDM: {"type":"pollResponse","pollResponse":[{"type":"brokerSelected","brokerSelected":{"brokerId":"local"}}]}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: GDM poll response: type:brokerSelected brokerSelected:{brokerId:"local"}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.brokerSelected{brokerID:"local"}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.BrokerSelected{BrokerID:"local"}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Sending to GDM: {"type":"event", "event":{"type":"brokerSelected", "brokerSelected":{"brokerId":"local"}}}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.pamError{status:25, msg:""}
Mar 23 15:34:06 ubuntu gnome-shell[3139]: authd: Broker selected local
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Got from GDM: {"type":"eventAck"}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: EventSend&{brokerId:"local"}result
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: LOGIN: exiting with error The return value should be ignored by PAM dispatch:
Mar 23 15:34:06 ubuntu authd-pam[4965]: GDM service running without JSON extension, skipping...
Mar 23 15:34:06 ubuntu authd-pam[4965]: LOGIN: exiting with error The return value should be ignored by PAM dispatch
Mar 23 15:34:10 ubuntu gdm-authd][4948]: pam_unix(gdm-authd:auth): The password hash "x" is unknown to libcrypt.
Mar 23 15:34:10 ubuntu gdm-authd][4948]: pam_unix(gdm-authd:auth): authentication failure; logname= uid=0 euid=0 tty=/dev/tty1 ruser= rhost= user=test@ubudev1.onmicrosoft.com
Mar 23 15:34:10 ubuntu gdm-authd][4948]: gkr-pam: unable to locate daemon control file
Mar 23 15:34:10 ubuntu gdm-authd][4948]: gkr-pam: stashed password to try later in open session
Mar 23 15:34:12 ubuntu gnome-shell[3139]: authd: Got a problem: Sorry, that didn’t work. Please try again.
Mar 23 15:34:12 ubuntu gnome-shell[3139]: authd: Cancelling authentication
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the listed broker-removal sequence and tracing the GDM, authd broker-selection, and authd-pam log flow, especially the local broker selection and PAM authentication messages. Confirm the behavior when no external brokers are configured and define done as selecting the existing authd user no longer leading to an invalid local-password prompt or failed authentication.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.