From: Anton Partanen
Subject: [PATCH] Retry transient unavailability for fingerprint only

Other non-interactive authenticators, notably smartcards, also use
PAM_AUTHINFO_UNAVAIL to report that no credential is present. Restrict the
retry behavior to fingerprint authenticators so absent smartcards remain
unavailable instead of repeatedly flashing in the UI.
---
 greeter/pamauthenticator.cpp | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/greeter/pamauthenticator.cpp b/greeter/pamauthenticator.cpp
index bb2521f..e27e61c 100644
--- a/greeter/pamauthenticator.cpp
+++ b/greeter/pamauthenticator.cpp
@@ -27,7 +27,7 @@ class PamWorker : public QObject
 {
     Q_OBJECT
 public:
-    PamWorker();
+    explicit PamWorker(bool retryOnAuthInfoUnavailable);
     ~PamWorker() override;
     Q_DISABLE_COPY_MOVE(PamWorker)
     void start(const QString &service, const QString &user);
@@ -52,6 +52,7 @@ private:
     bool m_unavailable = false;
     bool m_inAuthenticate = false;
     std::chrono::steady_clock::time_point m_nextAttemptAllowedTime;
+    const bool m_retryOnAuthInfoUnavailable;
     int m_result = -1;
     QString m_service;
 };
@@ -163,10 +164,11 @@ int PamWorker::converse(int n, const struct pam_message **msg, struct pam_respons
     return PAM_SUCCESS;
 }

-PamWorker::PamWorker()
+PamWorker::PamWorker(bool retryOnAuthInfoUnavailable)
     : QObject(nullptr)
     , m_conv({&PamWorker::converse, this})
     , m_nextAttemptAllowedTime(std::chrono::steady_clock::now())
+    , m_retryOnAuthInfoUnavailable(retryOnAuthInfoUnavailable)
 {
 }

@@ -176,9 +178,9 @@ void PamWorker::authenticate()
         pam_setcred(m_handle, PAM_REFRESH_CRED);
         /* ignore errors on refresh credentials. If this did not work we use the old ones. */
         Q_EMIT succeeded();
-    } else if (rc == PAM_AUTHINFO_UNAVAIL) {
+    } else if (rc == PAM_AUTHINFO_UNAVAIL && m_retryOnAuthInfoUnavailable) {
         Q_EMIT failed();
-    } else if (rc == PAM_MODULE_UNKNOWN) {
+    } else if (rc == PAM_AUTHINFO_UNAVAIL || rc == PAM_MODULE_UNKNOWN) {
         m_unavailable = true;
         Q_EMIT unavailabilityChanged(m_unavailable);
     } else {
@@ -268,7 +271,7 @@ PamAuthenticator::PamAuthenticator(const QString &service, const QString &user, N
       })
     , m_service(service)
     , m_authenticatorType(types)
-    , d(new PamWorker)
+    , d(new PamWorker(types.testFlag(NoninteractiveAuthenticatorType::Fingerprint)))
 {
     d->moveToThread(&m_thread);

--
2.51.0