diff --git a/0001-data-Add-support-for-unified-authentication.patch b/0001-data-Add-support-for-unified-authentication.patch new file mode 100644 index 0000000..fc2250c --- /dev/null +++ b/0001-data-Add-support-for-unified-authentication.patch @@ -0,0 +1,132 @@ +From 4c3f937ec0b694819823ea3ffb0aea361b62976b Mon Sep 17 00:00:00 2001 +From: Joan Torres Lopez +Date: Thu, 18 Sep 2025 16:42:37 +0200 +Subject: [PATCH 1/2] session: Log JSON request when GDM_DEBUG_JSON_REQUESTS is + set + +This is only useful for debugging and testing. +--- + daemon/gdm-session.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/daemon/gdm-session.c b/daemon/gdm-session.c +index 6f53b5dfa..2f820015c 100644 +--- a/daemon/gdm-session.c ++++ b/daemon/gdm-session.c +@@ -807,8 +807,9 @@ gdm_session_handle_custom_json_request (GdmDBusWorkerManager *worker_manager_in + if (conversation != NULL) { + set_pending_query (conversation, invocation); + +- g_debug ("GdmSession: emitting custom JSON request '%s' v%u", +- protocol, version); ++ if (g_getenv ("GDM_DEBUG_JSON_REQUESTS") != NULL) ++ g_message ("GdmSession: emitting custom JSON request '%s' v%u: %s", ++ protocol, version, request); + gdm_dbus_user_verifier_custom_json_emit_request (custom_json_interface, + service_name, + protocol, +-- +2.47.3 + + +From a823f0f0fd3262770599d24de7efd0c2462ca61f Mon Sep 17 00:00:00 2001 +From: Ray Strode +Date: Mon, 22 Jan 2024 09:40:39 -0500 +Subject: [PATCH 2/2] data: Add support for unified authentication + +At the moment, every authentication mechanism gets its own +separate PAM conversation. + +Some PAM modules, like pam_sss, support more than one way +to authenticate the user. + +Rather than starting several conversations, one for each +mechanism, this commit adds a new "unified" authentication +setting. +--- + data/meson.build | 1 + + data/org.gnome.login-screen.gschema.xml | 30 +++++++++++++++++++++++++ + data/pam-redhat/gdm-switchable-auth.pam | 18 +++++++++++++++ + 3 files changed, 49 insertions(+) + create mode 100644 data/pam-redhat/gdm-switchable-auth.pam + +diff --git a/data/meson.build b/data/meson.build +index 20d39a366..8d39d7506 100644 +--- a/data/meson.build ++++ b/data/meson.build +@@ -105,6 +105,7 @@ pam_data_files_map = { + 'gdm-smartcard', + 'gdm-password', + 'gdm-pin', ++ 'gdm-switchable-auth', + ], + 'openembedded': [ + 'gdm-autologin', +diff --git a/data/org.gnome.login-screen.gschema.xml b/data/org.gnome.login-screen.gschema.xml +index 7b5c54d1b..02dd4d0e4 100644 +--- a/data/org.gnome.login-screen.gschema.xml ++++ b/data/org.gnome.login-screen.gschema.xml +@@ -1,6 +1,36 @@ + + + ++ ++ true ++ ++ Whether or not to allow switchable authentication for login ++ ++ ++ The login screen can optionally allow a single PAM service to provide ++ multiple authentication mechanisms via a GDM PAM. ++ ++ ++ ++ true ++ ++ Whether or not to allow authentication via external web site ++ ++ ++ The login screen can optionally allow users to authenticate via ++ web login. ++ ++ ++ ++ true ++ ++ Whether or not to allow authentication using a passkey ++ ++ ++ The login screen can optionally allow users who have passkeys to log ++ in using those passkeys. ++ ++ + + true + +diff --git a/data/pam-redhat/gdm-switchable-auth.pam b/data/pam-redhat/gdm-switchable-auth.pam +new file mode 100644 +index 000000000..6648c3cec +--- /dev/null ++++ b/data/pam-redhat/gdm-switchable-auth.pam +@@ -0,0 +1,18 @@ ++auth substack switchable-auth ++auth optional pam_gnome_keyring.so ++auth include postlogin ++ ++account required pam_nologin.so ++account include switchable-auth ++ ++password substack switchable-auth ++-password optional pam_gnome_keyring.so use_authtok ++ ++session required pam_selinux.so close ++session required pam_loginuid.so ++session required pam_selinux.so open ++session optional pam_keyinit.so force revoke ++session required pam_namespace.so ++session include switchable-auth ++session optional pam_gnome_keyring.so auto_start ++session include postlogin +-- +2.47.3 + diff --git a/gdm.spec b/gdm.spec index 2606a71..b5a3b81 100644 --- a/gdm.spec +++ b/gdm.spec @@ -11,7 +11,7 @@ Name: gdm Epoch: 1 Version: 40.1 -Release: 42%{?dist} +Release: 43%{?dist} Summary: The GNOME Display Manager License: GPLv2+ @@ -76,6 +76,7 @@ Patch170001: 0001-session-record-Rework-wtmp-utmp-btmp-fields.patch # Passwordless GDM patches Patch180001: 0001-pam-extensions-Add-support-for-generic-GDM-CustomJSON.patch +Patch180002: 0001-data-Add-support-for-unified-authentication.patch # Non-upstreamable workarounds Patch66610001: 0001-data-reap-gdm-sessions-on-shutdown.patch @@ -359,6 +360,7 @@ dconf update || : %attr(0711, root, gdm) %dir /run/gdm %config %{_sysconfdir}/pam.d/gdm-pin %config %{_sysconfdir}/pam.d/gdm-smartcard +%config %{_sysconfdir}/pam.d/gdm-switchable-auth %config %{_sysconfdir}/pam.d/gdm-fingerprint %{_sysconfdir}/pam.d/gdm-launch-environment %{_udevrulesdir}/61-gdm.rules @@ -381,6 +383,10 @@ dconf update || : %{_libdir}/pkgconfig/gdm-pam-extensions.pc %changelog +* Tue Apr 14 2026 Joan Torres Lopez - 40.1-43 +- Backport passwordless feature to RHEL 9 + Resolves: https://redhat.atlassian.net/browse/RHEL-139178 + * Fri Mar 6 2026 Joan Torres Lopez - 40.1-42 - Terminate conflicting sesions started outside of GDM Resolves: RHEL-4108