rpms/gnome-shell
7
0
Fork 1
Code Issues Pull Requests Releases Activity

Fix credentialManagers authentication flow

Browse Source 
Related: https://redhat.atlassian.net/browse/RHEL-232973
This commit is contained in:
Joan Torres Lopez 2026-08-13 13:42:08 +02:00
parent 131dcd7678
commit 23756adaa0
No known key found for this signature in database
1 changed files with 114 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

126
post-changes-for-passwordless-gdm-backport.patch
View File

@ -1,7 +1,7 @@
From bc94cdc84421125da2dcc5fc3d627a475bd565cc Mon Sep 17 00:00:00 2001
From: Joan Torres Lopez <joantolo@redhat.com>
Date: Tue, 2 Jun 2026 12:07:45 +0200
Subject: [PATCH 01/12] Use Object.keys(this._sections) instead of
Subject: [PATCH 01/13] Use Object.keys(this._sections) instead of
this._sections.keys()
---
@ -28,7 +28,7 @@ index 5aaa45fd3..e2c516585 100644
From e1e99c9b443a60cf176d21b8538fc7f1ebd8ed65 Mon Sep 17 00:00:00 2001
From: Joan Torres Lopez <joantolo@redhat.com>
Date: Tue, 2 Jun 2026 12:52:09 +0200
Subject: [PATCH 02/12] Don't use _once timeout variants
Subject: [PATCH 02/13] Don't use _once timeout variants
---
js/gdm/authServices.js | 7 +++++--
@ -101,7 +101,7 @@ index cf6a4e1fb..0271d98f2 100644
From 9927abed68a443ee9f00ddcc5e4c48187a3c70da Mon Sep 17 00:00:00 2001
From: Joan Torres Lopez <joantolo@redhat.com>
Date: Tue, 9 Jun 2026 09:57:09 +0200
Subject: [PATCH 03/12] gdm: Use alternative to Promise.withResolvers()
Subject: [PATCH 03/13] gdm: Use alternative to Promise.withResolvers()
It doesn't exist in this version
---
@ -132,7 +132,7 @@ index e13d4106e..e5cf21c96 100644
From 8b06c49cb2e31b26cbf155bae0795fb7c0d7d6f6 Mon Sep 17 00:00:00 2001
From: Joan Torres Lopez <joantolo@redhat.com>
Date: Thu, 6 Aug 2026 23:58:46 +0200
Subject: [PATCH 04/12] gdm: Use old ButtonMask enum
Subject: [PATCH 04/13] gdm: Use old ButtonMask enum
In this version it still used as ONE, TWO and THREE
---
@ -201,7 +201,7 @@ index 3b6496296..34c371b8d 100644
From 4373ce16c8653c523fcca8879915254aa76d21d0 Mon Sep 17 00:00:00 2001
From: Joan Torres Lopez <joantolo@redhat.com>
Date: Fri, 7 Aug 2026 11:42:37 +0200
Subject: [PATCH 05/12] style: Fix color styles to adapt when on light-mode
Subject: [PATCH 05/13] style: Fix color styles to adapt when on light-mode
(classic-mode)
---
@ -263,7 +263,7 @@ index da04425bd..98ecf7b0f 100644
From 3745870fd893ae84cde12f4a84e4bd9b2ea65762 Mon Sep 17 00:00:00 2001
From: Joan Torres Lopez <joantolo@redhat.com>
Date: Wed, 12 Aug 2026 12:37:41 +0200
Subject: [PATCH 06/12] gdm: Restore util.js and misc/smartcardManager.js as
Subject: [PATCH 06/13] gdm: Restore util.js and misc/smartcardManager.js as
compat shims
Several symbols moved out of util.js into userVerifier.js and
@ -340,7 +340,7 @@ index 000000000..df62ec048
From bd1327dfb48dc9533d6e9055e6a42f0c1c1024bf Mon Sep 17 00:00:00 2001
From: Joan Torres Lopez <joantolo@redhat.com>
Date: Wed, 12 Aug 2026 12:37:50 +0200
Subject: [PATCH 07/12] authPrompt: Restore BeginRequestType as alias for
Subject: [PATCH 07/13] authPrompt: Restore BeginRequestType as alias for
ResetType
ResetType was renamed from BeginRequestType. Keep the old name
@ -371,7 +371,7 @@ index 31addc47f..4f7ceb86c 100644
From e5d4b76c4de043cb26f88065e623028970a5e1af Mon Sep 17 00:00:00 2001
From: Joan Torres Lopez <joantolo@redhat.com>
Date: Wed, 12 Aug 2026 12:38:25 +0200
Subject: [PATCH 08/12] Revert "gdm/authServices: Use per-request callbacks to
Subject: [PATCH 08/13] Revert "gdm/authServices: Use per-request callbacks to
handle services queries"
This reverts commit 929f864f1135a4225c09857ae3655d16de6c9251.
@ -812,7 +812,7 @@ index 6c63a313d..116c4ae1d 100644
From 3aae4d78f1432281589ff688d799c582bf80156b Mon Sep 17 00:00:00 2001
From: Joan Torres Lopez <joantolo@redhat.com>
Date: Wed, 12 Aug 2026 12:40:53 +0200
Subject: [PATCH 09/12] gdm: Restore positional signal signatures on
Subject: [PATCH 09/13] gdm: Restore positional signal signatures on
ShellUserVerifier
Signals on ShellUserVerifier ('ask-question', 'show-message',
@ -922,7 +922,7 @@ index 116c4ae1d..e5d3a1835 100644
From 9c61a84b465df3bd0c83bbc6e3be5db811b5d04e Mon Sep 17 00:00:00 2001
From: Joan Torres Lopez <joantolo@redhat.com>
Date: Wed, 12 Aug 2026 12:42:29 +0200
Subject: [PATCH 10/12] gdm: Add backward-compatible property and method shims
Subject: [PATCH 10/13] gdm: Add backward-compatible property and method shims
Several ShellUserVerifier properties and methods were dropped when
the class gained support for multiple concurrently-active AuthServices
@ -1062,7 +1062,7 @@ index e5d3a1835..2e863cb8b 100644
From 173fd8c7d0ace6b253df40d7db1260d0b202b17e Mon Sep 17 00:00:00 2001
From: Joan Torres Lopez <joantolo@redhat.com>
Date: Wed, 12 Aug 2026 13:08:48 +0200
Subject: [PATCH 11/12] authPrompt: updateSensitivity() signature
Subject: [PATCH 11/13] authPrompt: updateSensitivity() signature
updateSensitivity() started requiring a {sensitive} options object
instead of accepting a plain boolean. Restore its call signature.
@ -1098,7 +1098,7 @@ index d062cdc4b..8d4de6bde 100644
From f3ee5bfd61b258f90fcfda784bac7e99194a89a5 Mon Sep 17 00:00:00 2001
From: Joan Torres Lopez <joantolo@redhat.com>
Date: Wed, 12 Aug 2026 17:08:36 +0200
Subject: [PATCH 12/12] gdm/userVerifier: needsUsername should use every
Subject: [PATCH 12/13] gdm/userVerifier: needsUsername should use every
When every authServices needUsername then return true, otherwise return
false.
@ -1122,3 +1122,105 @@ index 2e863cb8b..e0a85c693 100644
--
2.55.0
From 8423550279da7eb204a8c0ddf4d2a94165a82fd7 Mon Sep 17 00:00:00 2001
From: Joan Torres Lopez <joantolo@redhat.com>
Date: Thu, 13 Aug 2026 13:18:41 +0200
Subject: [PATCH 13/13] gdm/authServicesLegacy: Fix credentialManagers authentication
There were a few guards to ensure authentication only works for
the selectedMechanism, however for credentialManagers, the selectedMechanism
isn't used. That was stopping authenticating through the credentialManager flow.
Bypass those guards only for credentialManagers.
---
js/gdm/authServicesLegacy.js | 44 ++++++++++++++++++++++++------------
1 file changed, 30 insertions(+), 14 deletions(-)
diff --git a/js/gdm/authServicesLegacy.js b/js/gdm/authServicesLegacy.js
index f257b55fc..b7592c065 100644
--- a/js/gdm/authServicesLegacy.js
+++ b/js/gdm/authServicesLegacy.js
@@ -258,17 +258,12 @@ export class AuthServicesLegacy extends AuthServices {
}
_handleOnSecretInfoQuery(serviceName, secretQuestion) {
- if (serviceName !== this._selectedMechanism?.serviceName)
+ // Try to auto-fill with credential manager token first
+ if (this._tryCredentialManagerAutoFill(serviceName))
return;
- let token = null;
- if (this._credentialManagers[serviceName])
- token = this._credentialManagers[serviceName].token;
-
- if (token) {
- this.answerQuery(serviceName, token);
+ if (serviceName !== this._selectedMechanism?.serviceName)
return;
- }
this.emit('ask-question', {
serviceName,
@@ -277,6 +272,20 @@ export class AuthServicesLegacy extends AuthServices {
});
}
+ _tryCredentialManagerAutoFill(serviceName) {
+ const credentialManager = this._credentialManagers[serviceName];
+ if (!credentialManager)
+ return false;
+
+ const token = credentialManager.token;
+ if (!token)
+ return false;
+
+ this._userVerifier.call_answer_query(
+ serviceName, token, this._cancellable).catch(logErrorUnlessCancelled);
+ return true;
+ }
+
_handleOnConversationStopped(serviceName) {
if (serviceName !== this._selectedMechanism?.serviceName &&
serviceName !== FINGERPRINT_SERVICE_NAME)
@@ -332,13 +341,8 @@ export class AuthServicesLegacy extends AuthServices {
}
_handleOnVerificationComplete(serviceName) {
- if (serviceName !== this._selectedMechanism?.serviceName)
- return;
-
- if (this._credentialManagers[serviceName]) {
+ if (this._credentialManagers[serviceName])
this._credentialManagers[serviceName].token = null;
- this._selectedMechanism = null;
- }
}
_handleOnChoiceListQuery(serviceName, promptMessage, list) {
@@ -357,12 +361,24 @@ export class AuthServicesLegacy extends AuthServices {
}
_handleCanStartService(serviceName) {
+ if (this._hasAnyCredentialManagerToken())
+ return this._hasCredentialManagerToken(serviceName);
+
return serviceName === this._selectedMechanism?.serviceName ||
(serviceName === FINGERPRINT_SERVICE_NAME &&
this._enabledMechanisms.some(m => m.serviceName === serviceName) &&
this._userName);
}
+ _hasAnyCredentialManagerToken() {
+ return Object.values(this._credentialManagers).some(cm => cm.token !== null);
+ }
+
+ _hasCredentialManagerToken(serviceName) {
+ const credentialManager = this._credentialManagers[serviceName];
+ return credentialManager && credentialManager.token !== null;
+ }
+
addCredentialManager(serviceName, credentialManager) {
if (this._credentialManagers[serviceName])
return;
--
2.55.0