Fingerprint Authentication with swaylock - Revision history

Prabuanand: changed commands to doas to make the page consistent and removed duplicate usage

2025-09-02T04:47:28Z

changed commands to doas to make the page consistent and removed duplicate usage

← Older revision		Revision as of 04:47, 2 September 2025
Line 12:		Line 12:

	To get the USB ID for your fingerprint reader, issue the command: {{Cmd\|$ lsusb \| grep finger}}		To get the USB ID for your fingerprint reader, issue the command: {{Cmd\|$ lsusb \| grep finger}}

	~~Once onfigured this allows you to unlock using either:~~
	* <code><enter password></code> → <code><hit enter></code>
	* <code><hit enter></code> → <code><touch fingerprint sensor></code>

	=== Configure policyKit permissions ===		=== Configure policyKit permissions ===
Line 27:		Line 23:
	});</nowiki>}}		});</nowiki>}}

	Ensure that correct permissions are set:{{Cmd\|<nowiki># chown root:root /etc/polkit-1/rules.d/50-fingerprint.rules		Ensure that correct permissions are set:{{Cmd\|<nowiki>$ doas chown root:root /etc/polkit-1/rules.d/50-fingerprint.rules
	# chmod 644 /etc/polkit-1/rules.d/50-fingerprint.rules</nowiki>}}		$ doas chmod 644 /etc/polkit-1/rules.d/50-fingerprint.rules</nowiki>}}

	Add your user to the <code>input</code> group:{{Cmd\|$ doas adduser $USER input}}		Add your user to the <code>input</code> group:{{Cmd\|$ doas adduser $USER input}}
Line 61:		Line 57:
	</nowiki>}}		</nowiki>}}

	Ensure that correct permissions are set:{{Cmd\|<nowiki># chown root:root /etc/pam.d/swaylock		Ensure that correct permissions are set:{{Cmd\|<nowiki>$ doas chown root:root /etc/pam.d/swaylock
	# chmod 644 /etc/pam.d/swaylock</nowiki>}}		$ doas chmod 644 /etc/pam.d/swaylock</nowiki>}}

	== Extending to other services ==		== Extending to other services ==

Prabuanand: added wikitags, category, see also section and reworded introduction and few other sentence

2025-09-02T04:34:59Z

added wikitags, category, see also section and reworded introduction and few other sentence

Show changes

Benaki at 16:17, 1 September 2025

2025-09-01T16:17:09Z

← Older revision		Revision as of 16:17, 1 September 2025
Line 2:		Line 2:

	Not all fingerprint readers are supported, see [https://fprint.freedesktop.org/supported-devices.html here].		Not all fingerprint readers are supported, see [https://fprint.freedesktop.org/supported-devices.html here].

	<code>lsusb \| grep finger</code>		<code>lsusb \| grep finger</code>

	will give you your USB ID.		will give you your USB ID.

Benaki: usb id

2025-09-01T16:16:57Z

usb id

← Older revision		Revision as of 16:16, 1 September 2025
Line 1:		Line 1:
	= Fingerprint Authentication with swaylock =		= Fingerprint Authentication with swaylock =

			Not all fingerprint readers are supported, see [https://fprint.freedesktop.org/supported-devices.html here].
			<code>lsusb \| grep finger</code>
			will give you your USB ID.

	This guide shows how to configure fingerprint authentication for swaylock on Alpine Linux, allowing you to unlock using either:		This guide shows how to configure fingerprint authentication for swaylock on Alpine Linux, allowing you to unlock using either:

Benaki at 14:11, 1 September 2025

2025-09-01T14:11:23Z

← Older revision		Revision as of 14:11, 1 September 2025
Line 29:		Line 29:
	doas adduser $USER input		doas adduser $USER input

	'''Note:''' You must log out and back in (or reboot) for the group membership to take effect.		'''Note:''' You must log out and back in (or reboot) for the group membership & PolicyKit rule to take effect.

	== Enroll Fingerprints ==		== Enroll Fingerprints ==

Benaki at 14:08, 1 September 2025

2025-09-01T14:08:25Z

← Older revision		Revision as of 14:08, 1 September 2025
Line 83:		Line 83:

	You can apply similar fingerprint authentication to other services by adding the same PAM configuration pattern to files in <code>/etc/pam.d/</code> such as:		You can apply similar fingerprint authentication to other services by adding the same PAM configuration pattern to files in <code>/etc/pam.d/</code> such as:
	* <code>sudo~~</code> or <code>doas~~</code>		* <code>sudo</code>
	* <code>polkit-1</code>		* <code>polkit-1</code>
	* <code>login</code>		* <code>login</code>
	* <code>su</code>		* <code>su</code>

Benaki: Fingerprint Authentication with swaylock

2025-09-01T14:06:50Z

Fingerprint Authentication with swaylock

New page

= Fingerprint Authentication with swaylock =

This guide shows how to configure fingerprint authentication for swaylock on Alpine Linux, allowing you to unlock using either:
* <code><enter password></code> → <code><hit enter></code>
* <code><hit enter></code> → <code><touch fingerprint sensor></code>

== Installation ==

Install the fprintd package:

doas apk add fprintd

== Configure PolicyKit Permissions ==

Upon installation, standard users are not authorized to enroll fingerprints. Create a PolicyKit rule to allow members of the <code>input</code> group to manage fingerprints:

doas tee /etc/polkit-1/rules.d/50-fingerprint.rules << 'EOF'
polkit.addRule(function (action, subject) {
if (action.id.indexOf("net.reactivated.fprint.") == 0) {
if (subject.isInGroup("input")) {
return polkit.Result.YES;
}
}
});
EOF

Add your user to the <code>input</code> group:

doas adduser $USER input

'''Note:''' You must log out and back in (or reboot) for the group membership to take effect.

== Enroll Fingerprints ==

If you previously enrolled fingerprints as root (or want to start fresh), delete existing enrollments:

# Delete fingerprints for current user
fprintd-delete $(whoami)

# If you accidentally enrolled as root, delete those too
doas fprintd-delete root

Enroll your fingerprint(s):

fprintd-enroll

Verify the enrollment works:

fprintd-verify

== Configure PAM for swaylock ==

Create the PAM configuration for swaylock:

doas tee /etc/pam.d/swaylock << 'EOF'
# Try password authentication first
auth sufficient pam_unix.so nullok
# If no password provided, try fingerprint
auth sufficient pam_fprintd.so ignore-empty-password
auth required pam_deny.so

# KWallet integration (optional)
-auth optional pam_kwallet.so
-auth optional pam_kwallet5.so
-session optional pam_kwallet.so auto_start
-session optional pam_kwallet5.so auto_start
EOF

== Usage ==

Once configured, swaylock will accept both authentication methods:

* '''Password authentication:''' Type your password and press Enter
* '''Fingerprint authentication:''' Press Enter without typing anything, then touch the fingerprint sensor

== Troubleshooting ==

* '''Permission denied during enrollment:''' Ensure you're in the <code>input</code> group and have logged out/in after adding the group
* '''Fingerprint recognized but doesn't unlock:''' Check that fingerprints are enrolled for the correct user (not root)
* '''No fallback to password:''' Verify the PAM configuration has <code>pam_unix.so</code> before <code>pam_fprintd.so</code>

== Extending to Other Services ==

You can apply similar fingerprint authentication to other services by adding the same PAM configuration pattern to files in <code>/etc/pam.d/</code> such as:
* <code>sudo</code> or <code>doas</code>
* <code>polkit-1</code>
* <code>login</code>
* <code>su</code>