Fingerprint Authentication with swaylock

Not all fingerprint readers are supported, see here.

lsusb | grep finger

will give you your USB ID.

This guide shows how to configure fingerprint authentication for swaylock on Alpine Linux, allowing you to unlock using either:

<enter password> → <hit enter>
<hit enter> → <touch fingerprint sensor>

Installation

Install the fprintd package:

doas apk add fprintd

Configure PolicyKit Permissions

Upon installation, standard users are not authorized to enroll fingerprints. Create a PolicyKit rule to allow members of the input group to manage fingerprints:

doas tee /etc/polkit-1/rules.d/50-fingerprint.rules << 'EOF'
polkit.addRule(function (action, subject) {
    if (action.id.indexOf("net.reactivated.fprint.") == 0) {
        if (subject.isInGroup("input")) {
            return polkit.Result.YES;
        }
    }
});
EOF

Add your user to the input group:

doas adduser $USER input

Note: You must log out and back in (or reboot) for the group membership & PolicyKit rule to take effect.

Enroll Fingerprints

If you previously enrolled fingerprints as root (or want to start fresh), delete existing enrollments:

# Delete fingerprints for current user
fprintd-delete $(whoami)

# If you accidentally enrolled as root, delete those too
doas fprintd-delete root

Enroll your fingerprint(s):

fprintd-enroll

Verify the enrollment works:

fprintd-verify

Configure PAM for swaylock

Create the PAM configuration for swaylock:

doas tee /etc/pam.d/swaylock << 'EOF'
# Try password authentication first
auth sufficient pam_unix.so nullok
# If no password provided, try fingerprint
auth sufficient pam_fprintd.so ignore-empty-password
auth required pam_deny.so

# KWallet integration (optional)
-auth    optional        pam_kwallet.so
-auth    optional        pam_kwallet5.so
-session optional        pam_kwallet.so auto_start
-session optional        pam_kwallet5.so auto_start
EOF

Usage

Once configured, swaylock will accept both authentication methods:

Password authentication: Type your password and press Enter
Fingerprint authentication: Press Enter without typing anything, then touch the fingerprint sensor

Troubleshooting

Permission denied during enrollment: Ensure you're in the input group and have logged out/in after adding the group
Fingerprint recognized but doesn't unlock: Check that fingerprints are enrolled for the correct user (not root)
No fallback to password: Verify the PAM configuration has pam_unix.so before pam_fprintd.so

Extending to Other Services

You can apply similar fingerprint authentication to other services by adding the same PAM configuration pattern to files in /etc/pam.d/ such as:

sudo
polkit-1
login
su