pam/gdm: Ignore GDM echo of our own auth mode selection - #1623
Draft
adombeck wants to merge 4 commits into
Draft
Conversation
adombeck
added
the
e2e-tests
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1623 +/- ##
==========================================
+ Coverage 84.24% 88.00% +3.76%
==========================================
Files 21 99 +78
Lines 1168 6839 +5671
Branches 0 111 +111
==========================================
+ Hits 984 6019 +5035
- Misses 184 764 +580
- Partials 0 56 +56 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
adombeck
force-pushed
the
1121-fix-double-mode-selection
branch
from
July 14, 2026 07:46
79225fb to
2e2ec41
Compare
3v1n0
reviewed
Jul 14, 2026
| } | ||
|
|
||
| func (m gdmModel) handlePollResponse(gdmPollResults []*gdm.EventData) tea.Cmd { | ||
| func (m *gdmModel) handlePollResponse(gdmPollResults []*gdm.EventData) tea.Cmd { |
Contributor
There was a problem hiding this comment.
Ideally these should never be pointers, but rather return the updated model, if that does not happen we need to figure out something else...
adombeck
force-pushed
the
1121-fix-double-mode-selection
branch
2 times, most recently
from
July 18, 2026 13:44
19e671f to
0ef1673
Compare
AccountsService can enumerate NSS users before authd has completed its socket-activated startup, leaving the GDM user cache without managed accounts until they log in once. Start authd as part of the NSS lookup target and make that target wait for the daemon to become ready. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
adombeck
added
e2e-tests
Allow e2e test PRs to opt into the authd-dev PPA through their description. The selected PPA replaces authd-edge while APT resolves the dependencies of the authd package built from the PR. This allows us to depend on the gnome-shell version from the authd-dev PPA. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Device authentication through GDM could hang on the QR screen even after the user completed the browser flow. The QR screen showed one device code while the broker kept polling for a different one, so the authorization the user granted was never observed and the login stalled until the device code expired. When an auth mode is auto-selected, the adapter both calls SelectAuthenticationMode (minting a device code and starting the poll) and tells GDM to select that mode. GDM echoes the selection back in its next poll, and the adapter treated that echo as a fresh selection, issuing a second SelectAuthenticationMode that minted a new device code and orphaned the first poll. Track the selection we send to GDM and drop its echo. The suppression is a one-shot consumed by the first matching echo, and is also cleared on any stage change, so a genuine re-selection of the same mode (the user navigating back to auth mode selection and picking it again) is still honored. A pure stage-change reset raced with the echo in the change-password flow; a pure one-shot swallowed legitimate re-selection of an auto-selected single mode. Combining both covers each gap. Use a value-returning poll handler so Bubble Tea owns model state transitions. Preserve the origin of selections so GDM-originated selections do not arm suppression intended only for the adapter-generated echo. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
adombeck
force-pushed
the
1121-fix-double-mode-selection
branch
2 times, most recently
from
July 19, 2026 12:50
a8b139e to
ad02d0c
Compare
A single gnome-shell version cannot represent both Noble and Resolute, because each series has a different upstream base and PPA versioning scheme. Generate the Breaks relationship from the changelog target suite and reject unknown suites to prevent silently omitting the constraint. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
Author
The authd Debian package built from this branch now requires a gnome-shell version that contains my fix. That is currently only available in the authd-dev PPA. Before merging this, we should copy these gnome-shell packages to the authd-edge PPA, and before releasing the next authd stable release, we should copy them to the authd PPA. |
adombeck
force-pushed
the
1121-fix-double-mode-selection
branch
from
July 20, 2026 12:29
ad02d0c to
6ffdb9d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Important
This is based on #1745
Device authentication through GDM could hang on the QR screen even after the user completed the browser flow. The QR screen showed one device code while the broker kept polling for a different one, so the authorization the user granted was never observed and the login stalled until the device code expired.
When an auth mode is auto-selected, the adapter both calls SelectAuthenticationMode (minting a device code and starting the poll) and tells GDM to select that mode. GDM echoes the selection back in its next poll, and the adapter treated that echo as a fresh selection, issuing a second SelectAuthenticationMode that minted a new device code and orphaned the first poll.
Track the selection we send to GDM and drop its echo. The suppression is a one-shot consumed by the first matching echo, and is also cleared on any stage change, so a genuine re-selection of the same mode (the user navigating back to auth mode selection and picking it again) is still honored. A pure stage-change reset raced with the echo in the change-password flow; a pure one-shot swallowed legitimate re-selection of an auto-selected single mode. Combining both covers each gap.
e2e-ppa: authd-dev
Closes #1121
UDENG-10830
Important
This fixes #1121 but causes #1424 to occur on almost each login attempt, so we have to release this together with the fix for #1424.