gnome-about-me misses fprintd for fingerprint authentication support

Needs the software as well as a patched libusb from here: http://reactivated.net/fprint/wiki/Fprintd

I see. As this requires a not yet released version of libusb, we'll probably have to wait for it then.
However if someone put's up a PPA for this I would be willing to test :-)

marking as wishlist, since we seem to be missing an updated libusb.

Added bug report to package fprintd: bug #376540

Is it possible that it will be fixed in Karmic? It's a bit of shame that everything is in place since the beginning of 2009 and Ubuntu can't keep up with it.

A bit frustrating that this works right out of the box with Fedora 11 on my Thinkpad R52 that I use for testing, while it seems to be a lot of work getting it up and running in Ubuntu (at least in Jaunty).

libusb-1.0 (the version that seems to be needed) is now in the repositories, but the installed version is still 0.1-4 in current karmic. Does anyone know why?

Any idea if this can be fixed for lucid?

it could if somebody shows interest working on that one

I started a PPA for this. Fprintd and all related libraries and tools have been packaged and are ready for being tested.

https://launchpad.net/~fingerprint/+archive/fprint

Please read the PPA's description for further details.

Just wanted to confirm the software from the ppa runs correctly using an AuthenTec AES2501, Bus 004 Device 003: ID 08ff:2580 AuthenTec, Inc. AES2501 Fingerprint Sensor.

Running Lucid updated today.

Two things tho:

1) Fprint_demo doesn't have access to the scanner - needs access to the correct USB device, in my case it says:

libusb couldn't open USB device /dev/bus/usb/004/003: Permission denied.
libusb requires write access to USB device nodes.

That doesn't matter much tho, since it seems the "About me" way of doing things stores the fingerprints elsewhere than fprint-demo, so no permission "fix" is needed then.

2) Because of 1), when using the about me method, there is only enrollment. I think the program should ask at least twice when enrolling using the About Me method, and try and verify if the two scans match eachother, and if so, accept the fingerprints.

That is sort of a upstream whishlist question tho:)

Oh, actually, three things:

Could it be possible to maybe make the pam_fprint unlock the keydatabase in keyring? So that I don't have to type in my wifi passwords, etc, after logging with my fingerprint?

That would be awesome!

Seem to work fine on my Lenovo Thinkpad R61, thank you!

//Mattias

mån 2010-02-22 klockan 04:10 +0000 skrev David Jurenka:

> I started a PPA for this. Fprintd and all related libraries and tools
> have been packaged and are ready for being tested.
>
> https://launchpad.net/~fingerprint/+archive/fprint
>
> Please read the PPA's description for further details.
>

It worked fine on my Dell xps m1330 except for the glitches you already mentioned in the PPA. Thanks.

imachine I agree with you, it would be nice.
it should be a kind of interaction between pam fprint and pam gnome-keyring ?

I tried to change common-auth using
auth [success=2 default=ignore] pam_fprint.so
instead of
auth sufficient pam_fprint.so

for let execute optional pam keyring, but without success

@all
Thanks for your confirmations!

@imachine
1. Strange, are your running the version from the PPA (1:0.4+git20080303)?
2. Agreed. This should be addressed by GNOME, however.
3. This is number 2 under Random Notes in the PPA's description. I've just expanded this point with a more detailed discussion of this issue and its solutions.

@jedioetzi
libpam-fprint is deprecated. Remove it, use libpam-fprintd from the PPA and follow the instructions from the archive's description. Additionaly, please note that manual editing of /etc/pam.d/common-auth is discouraged and one should use profiles and pam-auth-update instead. The packages from the repo take care of all the settings automatically.

I also use an Authentec AES2501 sensor and have today made the switch to your PPA.

There have been no problems. Logging in, sudo-ing in a console, starting gksu-applications like synaptic, unlocking the screen - everything works :)

The fingerprint reader feels more reliable than before, with less errors recognizing my fingerprint.

Previously I had been using libpam-fprint (without the d) with manual modifications to /etc/pam.d/common-auth. But purging the package, commenting out my manual changes and running "sudo pam-auth-update --force" brought everything to the desired settings.

mån 2010-02-22 klockan 15:23 +0000 skrev imachine:

> Oh, actually, three things:
>
> Could it be possible to maybe make the pam_fprint unlock the keydatabase
> in keyring? So that I don't have to type in my wifi passwords, etc,
> after logging with my fingerprint?

Well currently no, since it needs a password to encrypt/decrypt the
passwords for secure storage on disk. The following bug discusses just
this and the idea seems to be to have multiple passwords/secrets to
unlock the keyring. That way pam-fprintd could provide some secret based
on the fingerprint to unlock the keyring.

https://bugzilla.gnome.org/show_bug.cgi?id=501204

However, it doesn't seem like someone is working very hard to fix
this...

//Mattias

thanks for the help, it works!

I still have the problem that if I start synaptic I don't see the credential dialog. After swiping finger synaptic starts.
This happens with several admin apps, not all.

for gnome could be an idea to use an hash derived from the original fingerprint as password for the keyring?

when first swipe fails, it will be asked for swiping again but often nothing happens if I swipe again and after a while the message "Verification timed out" appears

I've made several changes and improvements to the packages to address the outstanding issues. I've also completely rewritten the PPA's description to include answers to the most common questions.

Ad keyring: Unlocking an encrypted keyring with a fingerprint is not technically feasible. See the PPA's description for a detailed rationale. Fixing the above mentioned bug wouldn't be of any help in this case.

Ad starting Synaptic and other graphical applications running with root privileges: The current way of launching these applications (gksu) has major limitations and will (almost surely) never work with fingerprint authentication. A replacement has been packaged in the PPA (available only for Lucid, unfortunately). And again please refer to the PPA's description for details on its installation and use.

Ad jedioetzi's timeouts: This might be related to your hardware as I can't seem to be able to reproduce it. If you can replicate it more or less reliably, could you please provide detailed steps?

with the new packages the problem not occours, anyway the problem I had was with AuthenTec AES2501:
1) swipe with a finger not configured -> the swipe fails
2) you will asked for another swipe
3) swipe again with the correct finger -> nothing happens
4) the only way out is to wait the timeout and enter the password

with new library

3) swipe again with the correct finger -> authenticated
or
3) swipe again with another finger -> you will asked for another swipe (max 3 attempts)

for synaptic and some other administrative apps look at
https://bugs.launchpad.net/ubuntu/+source/gksu/+bug/86843
https://bugs.launchpad.net/ubuntu/+source/pam-fprint/+bug/347778

with keyring, as you said the problem is not trivial.

thanks for the fixes!

sorry, rollback: the problem of above (swiping again nothing happens) exists with the new libraries too
can I provide some logs?

Hi!

Thank you very much for your effort, Unfortunately, this won't work for me. I'm running current Lucid.

My device is 147e:2016 Upek Biometric Touchchip/Touchstrip Fingerprint Sensor

Dmesg output:

[ 2321.822515] usb 3-2: new full speed USB device using uhci_hcd and address 5
[ 2322.001860] usb 3-2: configuration #1 chosen from 1 choice

I've installed these packages with apt (and also gksu-polkit):

fprint-demo 1:0.4+git20080303-0~ppa1~lucid1
fprintd 0.0.0+git20090124-0~ppa2~lucid1
libfprint0 0.1.0~pre2-1~ppa6~lucid1
libpam-fprintd 0.0.0+git20090124-0~ppa2~lucid1

Then, I go to "about me" and I try to set up my finger, but nothing happens. I get the message "Swipe your finger again" over and over. Nothing happens.

The program fprint_demo says "Device ready for use" with the driver upeksonly. I press the "Enroll" button and I get the "Scan your finger now" dialog, but again nothing happens.

Then I try fprintd-enroll:

$ fprintd-enroll
Using device /net/reactivated/Fprint/Device/0
Enrolling right index finger.
Enroll result: enroll-unknown-error

Some thoughts? Thank you.

Jorge, this is probably the same bug as https://bugzilla.redhat.com/show_bug.cgi?id=504399 . There seem be to several variants of the 147e:2016 device, and not all of them work correctly with FPrint. See also http://reactivated.net/fprint/wiki/Unsupported_devices#UPEK_TCRD4C_.28newer_Eikon.29 .

Jorge and jedioetzi, should you want to dig deeper into the issues, you can restart fprintd in debugging mode by running
sudo killall fprintd
sudo /usr/lib/fprintd/fprintd -t
You will get even more verbose output if you replace the libfprint0 package with the libfprint-debug0 variant. The best place to submit any findings is then the upstream mailing list. However, be warned that, sadly, there is pretty much no upstream activity at the moment.

** Message: now monitoring fd 7
** Message: device 0 claim status 0
** Message: adding finger 7 to the gallery
** Message: start identification device 0
** Message: identify_cb: result verify-retry-scan (100)
Segmentation fault

the fault appears when the swipe fails

I will try now the debug version

I 'm not able to find the debug version of libfprint
there is an deb package for it or should be builded from source?
I use ubuntu karmic 64 bit.
thanks

ok now I found the debug package.
I attached the log of the first swipe (that fails) and the second that cause the segfault

f.y.i. the pam fprint works correctly without segfaults

Thank you David,

I've managed to get my device working by modifying the upekts driver. I've sent the patch upstream but it can't be included as-is because I've just replaced support of the original device upekts was intended for with support to my device.

To solve this I could make upekts work with both devices, or add this modified version as another driver with another name. But I still have the ID problem: the ID 147e:2016 is also used by the upeksonly driver for another device. What can we do about this?

The patch on the fprint mailing list, in case someone is interested: http://<email address hidden>/msg01424.html

Great job, Jorge! I am closely following the upstream discussion you initiated, and as soon as the resulting patches don't introduce any regression, I will definitely include them in the packages so that you can get a wider audience to test your new driver.

The issue with colliding IDs may become increasingly common. For instance, if I quote the documentation to UPEK's BSAPI SDK: “UPEK TCD4C and TCD4E sensors exist in two variants—with and without the EEPROM chip. The NVM func-
tionality for sensors without EEPROM must be emulated.” The same documentation also describes several API calls whose inspection may come in handy for differentiating between the variants of your sensor.

That configuration dialog is deprecated in GNOME3 and Oneiric so closing the bug, feel free to open new bugs about other issues you might find though

Thanks for packaging fprint. This has been working great for some years now. However with the latest version of Ubuntu (Trusty) a new lock screen was introduced. fprint doesn't work with this lockscreen for me. In lack of another place and in doubt whether this is upstream, I post this bug here.

As mentioned, fprint and Unity have been getting along great until I updated to Trusty. When I use Gnome instead of Unity, the Gnome lock screen is used which still supports fprint beautifully. However there is an issue with the new Unity lock screen and fprint.

This is what I do:
1) Suspend (e.g. by closing the lid of my Thinkpad)
2) Wake up Laptop and wait for the lock screen to show up
3) See the prompt to swipe my finger where the password prompt usually is (this is expected behaviour!)

What I expect:
Usually the green LED built in to my fingerprint reader lights up and I am able to login using it. Pressing ESC instead of swiping a finger should fall back to the password prompt (that is what I'm used to from both fprint with earlier versions of Ubuntu and fprint with Gnome).

What happens instead:
The green light doesn't light up and swiping has no effect. Pressing ESC does not fall back to password prompt. The only way to login is using the menue in the right of the top panel and go to the 'switch user' screen where I can enter my password to login.

It almost seems as if the fingerprint reader does not wake up from suspend. However it doesn't seem to be a driver issue because it works flawelessly with Gnome.

Any help to fix this is appreciated. I'd also be happy to provide you with more information if necessary. Please tell me if this should be posted upstream.

Thanks