I’m exploring a PAM compatibility layer that allows GNOME Keyring to be unlocked after non-password authentication by supplying a replacement PAM_AUTHTOK before pam_gnome_keyring.so runs. Has this approach been tried before, and are there any architectural reasons it wouldn’t be recommended?
By non-password do you mean fingerprint authentication, or smartcard? Cause the fingerprint explicitly does not unlock the keyring cause it’s not secure to do so currently. In the future this might change with the new generation of fingerprint sensors that windows requires, but for the time being most of them are very insecure.
Yeah, I mean smartcards/NFC, not fingerprints. Specifically DESFire AES-128 mutual auth. I’m working on a centralized NFC authentication service with identity resolution through FreeIPA.
The goal is to keep GNOME Keyring functional without workarounds like a blank password.