GDM asks for password when broker is disabled
- Dominant language
- Go
- Stars
- 308
- Forks
- 41
- Avg merge
- 2d 4h
- Merged PRs (30d)
- 58
Description
GDM asks me for a password when selecting an existing authd user when no authd brokers are configured:
Any password I enter results in "Sorry that didn't work. Please try again.", also if I enter the correct local password of that user.
I'm able to reproduce this on Noble and Resolute.
Steps to reproduce:
1. Configure a broker (I used `authd-msentraid`)
2. Authenticate with the broker
3. `sudo rm /etc/authd/brokers.d/*`
4. `sudo systemctl restart authd`
5. In GDM, select the existing authd user.
Relevant logs (from Noble):
```
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Connecting to unix:///run/authd.sock
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Sending to GDM: {"type":"hello"}
Mar 23 15:34:06 ubuntu gnome-shell[3139]: authd: Starting authd protocol
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Got from GDM: {"type":"hello","hello":{"version":1}}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Gdm Reply is type:hello hello:{version:1}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.initHealthCheck{}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Sending to GDM: {"type":"request", "request":{"type":"uiLayoutCapabilities", "uiLayoutCapabilities":{}}}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Got from GDM: {"type":"response","response":{"type":"uiLayoutCapabilities","uiLayoutCapabilities":{"supportedUiLayouts":[{"type":"form","label":"required","wait":"optional:true,false","entry":"optional:chars,chars_password,digits,digits_password"},{"type":"newpassword","label":"required","entry":"optional:chars,chars_password,digits,digits_password"},{"type":"qrcode","label":"required","button":"optional","wait":"required:true,false","content":"required","code":"optional"}]}}}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.supportedUILayoutsReceived{layouts:[]*authd.UILayout{(*authd.UILayout)(0xc0001909a0), (*authd.UILayout)(0xc000190c40), (*authd.UILayout)(0xc000190cb0)}}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.brokersListReceived{brokers:[]*authd.ABResponse_BrokerInfo{(*authd.ABResponse_BrokerInfo)(0xc000326be0)}}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.BrokerListReceived{}, brokers: []*authd.ABResponse_BrokerInfo{(*authd.ABResponse_BrokerInfo)(0xc000326be0)}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Sending to GDM: {"type":"event", "event":{"type":"brokersReceived", "brokersReceived":{"brokersInfos":[{"id":"local", "name":"local", "brandIcon":""}]}}}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.userSelected{username:"test@ubudev1.onmicrosoft.com"}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Sending to GDM: {"type":"event", "event":{"type":"userSelected", "userSelected":{"userId":"test@ubudev1.onmicrosoft.com"}}}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.UsernameSelected{}, user: "test@ubudev1.onmicrosoft.com"
Mar 23 15:34:06 ubuntu authd[2279]: Last used broker "2102147668" is not available for user "test@ubudev1.onmicrosoft.com", letting the user select a new one
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.brokerSelectionRequired{}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.ChangeStage{Stage:"brokerSelection"}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: *adapter.authModeSelectionModel: Reset
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.List: Focus
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Got from GDM: {"type":"eventAck"}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: EventSend&{brokersInfos:{id:"local" name:"local" brand_icon:""}}result
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.listFocused{id:0x1}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.StageChanged{Stage:"brokerSelection"}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Sending to GDM: {"type":"request", "request":{"type":"changeStage", "changeStage":{"stage":"brokerSelection"}}}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Got from GDM: {"type":"eventAck"}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: EventSend&{userId:"test@ubudev1.onmicrosoft.com"}result
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Got from GDM: {"type":"response","response":{"type":"changeStage","ack":{}}}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Gdm stage change to brokerSelection sent
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Got from GDM: {"type":"pollResponse","pollResponse":[{"type":"brokerSelected","brokerSelected":{"brokerId":"local"}}]}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: GDM poll response: type:brokerSelected brokerSelected:{brokerId:"local"}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.brokerSelected{brokerID:"local"}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.BrokerSelected{BrokerID:"local"}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Sending to GDM: {"type":"event", "event":{"type":"brokerSelected", "brokerSelected":{"brokerId":"local"}}}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: adapter.pamError{status:25, msg:""}
Mar 23 15:34:06 ubuntu gnome-shell[3139]: authd: Broker selected local
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: Got from GDM: {"type":"eventAck"}
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: EventSend&{brokerId:"local"}result
Mar 23 15:34:06 ubuntu gdm-session-wor[4948]: LOGIN: exiting with error The return value should be ignored by PAM dispatch:
Mar 23 15:34:06 ubuntu authd-pam[4965]: GDM service running without JSON extension, skipping...
Mar 23 15:34:06 ubuntu authd-pam[4965]: LOGIN: exiting with error The return value should be ignored by PAM dispatch
Mar 23 15:34:10 ubuntu gdm-authd][4948]: pam_unix(gdm-authd:auth): The password hash "x" is unknown to libcrypt.
Mar 23 15:34:10 ubuntu gdm-authd][4948]: pam_unix(gdm-authd:auth): authentication failure; logname= uid=0 euid=0 tty=/dev/tty1 ruser= rhost= user=test@ubudev1.onmicrosoft.com
Mar 23 15:34:10 ubuntu gdm-authd][4948]: gkr-pam: unable to locate daemon control file
Mar 23 15:34:10 ubuntu gdm-authd][4948]: gkr-pam: stashed password to try later in open session
Mar 23 15:34:12 ubuntu gnome-shell[3139]: authd: Got a problem: Sorry, that didn’t work. Please try again.
Mar 23 15:34:12 ubuntu gnome-shell[3139]: authd: Cancelling authentication
```
Contributor guide
Research direction
Start by reproducing the listed broker-removal sequence and tracing the GDM, authd broker-selection, and authd-pam log flow, especially the local broker selection and PAM authentication messages. Confirm the behavior when no external brokers are configured and define done as selecting the existing authd user no longer leading to an invalid local-password prompt or failed authentication.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100