Merge lp:~robert-ancell/lightdm/passive-authentication into lp:lightdm

[Robert Ancell]

Add support for authentication that is not initiated graphically from the greeter, e.g. using fingerprint scanners / smartcard systems.

[lp:~robert-ancell/lightdm/passive-authentication]

1537. By Robert Ancell on 2013-07-21

Merge with trunk

1538. By Robert Ancell on 2013-07-21

Remove cclosure that is no longer required

1539. By Robert Ancell on 2013-07-21

Merge with trunk

1540. By Robert Ancell on 2013-08-17

Merge with trunk

1541. By Robert Ancell on 2013-08-18

Merge with trunk

1542. By Robert Ancell on 2013-08-18

Remove stray files

1543. By Robert Ancell on 2013-08-21

Merge with trunk

1544. By Robert Ancell on 2013-09-20

Merge with trunk

1545. By Robert Ancell on 2013-10-30

Merge with trunk

1546. By Robert Ancell on 2014-03-04

Merge with trunk

1547. By Robert Ancell on 2014-04-29

Merge with trunk

1548. By Robert Ancell on 2014-10-02

Merge with trunk

Unmerged revisions

1548. By Robert Ancell on 2014-10-02

Merge with trunk

1547. By Robert Ancell on 2014-04-29

Merge with trunk

1546. By Robert Ancell on 2014-03-04

Merge with trunk

1545. By Robert Ancell on 2013-10-30

Merge with trunk

1544. By Robert Ancell on 2013-09-20

Merge with trunk

1543. By Robert Ancell on 2013-08-21

Merge with trunk

1542. By Robert Ancell on 2013-08-18

Remove stray files

1541. By Robert Ancell on 2013-08-18

Merge with trunk

1540. By Robert Ancell on 2013-08-17

Merge with trunk

1539. By Robert Ancell on 2013-07-21

Merge with trunk

=== modified file 'data/lightdm.conf'
--- data/lightdm.conf	2014-09-10 03:33:25 +0000
+++ data/lightdm.conf	2014-10-02 07:53:03 +0000
@@ -68,6 +68,7 @@
 # greeter-setup-script = Script to run when starting a greeter (runs as root)
 # session-setup-script = Script to run when starting a user session (runs as root)
 # session-cleanup-script = Script to run when quitting a user session (runs as root)
+# passive-services = PAM services to run which are triggered by external events (e.g. fingerprint, smartcard)
 # autologin-guest = True to log in as guest by default
 # autologin-user = User to log in with by default (overrides autologin-guest)
 # autologin-user-timeout = Number of seconds to wait before loading default user
@@ -109,6 +110,7 @@
 #greeter-setup-script=
 #session-setup-script=
 #session-cleanup-script=
+#passive-services=
 #autologin-guest=false
 #autologin-user=
 #autologin-user-timeout=0

=== modified file 'liblightdm-gobject/greeter.c'
--- liblightdm-gobject/greeter.c	2014-09-29 23:42:38 +0000
+++ liblightdm-gobject/greeter.c	2014-10-02 07:53:03 +0000
@@ -41,6 +41,7 @@
     AUTOLOGIN_TIMER_EXPIRED,
     IDLE,
     RESET,
+    OFFER_AUTHENTICATION,
     LAST_SIGNAL
 };
 static guint signals[LAST_SIGNAL] = { 0 };
@@ -107,6 +108,7 @@
     GREETER_MESSAGE_SET_LANGUAGE,
     GREETER_MESSAGE_AUTHENTICATE_REMOTE,
     GREETER_MESSAGE_ENSURE_SHARED_DIR,
+    GREETER_MESSAGE_CHANGE_AUTHENTICATION,
 } GreeterMessage;
 
 /* Messages from the server to the greeter */
@@ -119,6 +121,7 @@
     SERVER_MESSAGE_SHARED_DIR_RESULT,
     SERVER_MESSAGE_IDLE,
     SERVER_MESSAGE_RESET,
+    SERVER_MESSAGE_OFFER_AUTHENTICATION,
 } ServerMessage;
 
 /* Request sent to server */
@@ -509,6 +512,20 @@
 }
 
 static void
+handle_offer_authentication (LightDMGreeter *greeter, guint8 *message, gsize message_length, gsize *offset)
+{
+    gchar *service;
+
+    service = read_string (message, message_length, offset);
+
+    g_debug ("Offering authentication with service %s", service);
+
+    g_signal_emit (G_OBJECT (greeter), signals[OFFER_AUTHENTICATION], 0, service);
+
+    g_free (service);
+}
+
+static void
 handle_idle (LightDMGreeter *greeter, guint8 *message, gsize message_length, gsize *offset)
 {
     g_signal_emit (G_OBJECT (greeter), signals[IDLE], 0);
@@ -595,6 +612,9 @@
     case SERVER_MESSAGE_PROMPT_AUTHENTICATION:
         handle_prompt_authentication (greeter, message, message_length, &offset);
         break;
+    case SERVER_MESSAGE_OFFER_AUTHENTICATION:
+        handle_offer_authentication (greeter, message, message_length, &offset);
+        break;
     case SERVER_MESSAGE_END_AUTHENTICATION:
         handle_end_authentication (greeter, message, message_length, &offset);
         break;
@@ -1212,6 +1232,40 @@
 }
 
 /**
+ * lightdm_greeter_change_authentication:
+ * @greeter: A #LightDMGreeter
+ * @service: The service to change to (as received from ::offer-authentication)
+ *
+ * Sets the requested service as the active authentication.
+ **/
+void
+lightdm_greeter_change_authentication (LightDMGreeter *greeter, const gchar *service)
+{
+    LightDMGreeterPrivate *priv;
+    guint8 message[MAX_MESSAGE_LENGTH];
+    gsize offset = 0;
+
+    g_return_if_fail (LIGHTDM_IS_GREETER (greeter));
+
+    priv = GET_PRIVATE (greeter);
+
+    g_return_if_fail (priv->connected);
+
+    priv->cancelling_authentication = FALSE;
+    priv->authenticate_sequence_number++;
+    priv->in_authentication = TRUE;
+    priv->is_authenticated = FALSE;
+    g_free (priv->authentication_user);
+    priv->authentication_user = NULL;
+
+    g_debug ("Changing to authentication service %s...", service);
+    write_header (message, MAX_MESSAGE_LENGTH, GREETER_MESSAGE_CHANGE_AUTHENTICATION, int_length () + string_length (service), &offset);
+    write_int (message, MAX_MESSAGE_LENGTH, priv->authenticate_sequence_number, &offset);
+    write_string (message, MAX_MESSAGE_LENGTH, service, &offset);
+    send_message (greeter, message, offset);
+}
+
+/**
  * lightdm_greeter_respond:
  * @greeter: A #LightDMGreeter
  * @response: Response to a prompt
@@ -1866,6 +1920,27 @@
                       G_TYPE_NONE, 0);
 
     /**
+     * LightDMGreeter::offer-authentication:
+     * @greeter: A #LightDMGreeter
+     * @service: The service that can be changed to
+     *
+     * The ::offer-authentication signal gets emitted when an uninitiated
+     * authentication starts, for example a smartcard or fingerprint is
+     * presented.
+     *
+     * If this authentication can be used the application should then call
+     * lightdm_greeter_change_authentication().
+     **/
+    signals[OFFER_AUTHENTICATION] =
+        g_signal_new ("offer-authentication",
+                      G_TYPE_FROM_CLASS (klass),
+                      G_SIGNAL_RUN_LAST,
+                      G_STRUCT_OFFSET (LightDMGreeterClass, offer_authentication),
+                      NULL, NULL,
+                      NULL,
+                      G_TYPE_NONE, 1, G_TYPE_STRING);
+
+    /**
      * LightDMGreeter::idle:
      * @greeter: A #LightDMGreeter
      *

=== modified file 'liblightdm-gobject/lightdm/greeter.h'
--- liblightdm-gobject/lightdm/greeter.h	2014-09-29 23:42:38 +0000
+++ liblightdm-gobject/lightdm/greeter.h	2014-10-02 07:53:03 +0000
@@ -29,6 +29,7 @@
 #define LIGHTDM_GREETER_SIGNAL_AUTOLOGIN_TIMER_EXPIRED "autologin-timer-expired"
 #define LIGHTDM_GREETER_SIGNAL_IDLE                    "idle"
 #define LIGHTDM_GREETER_SIGNAL_RESET                   "reset"
+#define LIGHTDM_GREETER_SIGNAL_OFFER_AUTHENTICATION    "offer-authentication"
 
 /**
  * LightDMPromptType:
@@ -67,12 +68,12 @@
     void (*autologin_timer_expired)(LightDMGreeter *greeter);
     void (*idle)(LightDMGreeter *greeter);
     void (*reset)(LightDMGreeter *greeter);
+    void (*offer_authentication) (LightDMGreeter *greeter, const gchar *service);
 
     /* Reserved */
     void (*reserved1) (void);
     void (*reserved2) (void);
     void (*reserved3) (void);
-    void (*reserved4) (void);
 } LightDMGreeterClass;
 
 GType lightdm_greeter_get_type (void);
@@ -123,6 +124,8 @@
 
 void lightdm_greeter_authenticate_remote (LightDMGreeter *greeter, const gchar *session, const gchar *username);
 
+void lightdm_greeter_change_authentication (LightDMGreeter *greeter, const gchar *service);
+
 void lightdm_greeter_respond (LightDMGreeter *greeter, const gchar *response);
 
 void lightdm_greeter_cancel_authentication (LightDMGreeter *greeter);

=== modified file 'liblightdm-qt/QLightDM/greeter.h'
--- liblightdm-qt/QLightDM/greeter.h	2014-09-19 03:16:14 +0000
+++ liblightdm-qt/QLightDM/greeter.h	2014-10-02 07:53:03 +0000
@@ -77,6 +77,7 @@
     void authenticateAsGuest();
     void authenticateAutologin();
     void authenticateRemote(const QString &session=QString(), const QString &username=QString());
+    void changeAuthentication(const QString &service);
     void respond(const QString &response);
     void cancelAuthentication();
     void setLanguage (const QString &language);
@@ -91,6 +92,7 @@
     void autologinTimerExpired();
     void idle();
     void reset();
+    void offerAuthentication(QString service);
 
 private:
     GreeterPrivate *d_ptr;

=== modified file 'liblightdm-qt/greeter.cpp'
--- liblightdm-qt/greeter.cpp	2014-09-29 23:42:38 +0000
+++ liblightdm-qt/greeter.cpp	2014-10-02 07:53:03 +0000
@@ -35,7 +35,7 @@
     static void cb_autoLoginExpired(LightDMGreeter *greeter, gpointer data);
     static void cb_idle(LightDMGreeter *greeter, gpointer data);
     static void cb_reset(LightDMGreeter *greeter, gpointer data);
-
+    static void cb_offerAuthentication(LightDMGreeter *greeter, const gchar *service, gpointer data);
 private:
     Q_DECLARE_PUBLIC(Greeter)
 };
@@ -54,6 +54,7 @@
     g_signal_connect (ldmGreeter, LIGHTDM_GREETER_SIGNAL_AUTOLOGIN_TIMER_EXPIRED, G_CALLBACK (cb_autoLoginExpired), this);
     g_signal_connect (ldmGreeter, LIGHTDM_GREETER_SIGNAL_IDLE, G_CALLBACK (cb_idle), this);
     g_signal_connect (ldmGreeter, LIGHTDM_GREETER_SIGNAL_RESET, G_CALLBACK (cb_reset), this);
+    g_signal_connect (ldmGreeter, LIGHTDM_GREETER_SIGNAL_OFFER_AUTHENTICATION, G_CALLBACK (cb_offerAuthentication), this);
 }
 
 void GreeterPrivate::cb_showPrompt(LightDMGreeter *greeter, const gchar *text, LightDMPromptType type, gpointer data)
@@ -106,6 +107,14 @@
     Q_EMIT that->q_func()->reset();
 }
 
+void GreeterPrivate::cb_offerAuthentication(LightDMGreeter *greeter, const gchar *service, gpointer data)
+{
+    Q_UNUSED(greeter);
+    GreeterPrivate *that = static_cast<GreeterPrivate*>(data);
+    QString service_string = QString::fromUtf8(service);
+    Q_EMIT that->q_func()->offerAuthentication(service_string);
+}
+
 Greeter::Greeter(QObject *parent) :
     QObject(parent),
     d_ptr(new GreeterPrivate(this))
@@ -154,6 +163,12 @@
     lightdm_greeter_authenticate_remote(d->ldmGreeter, session.toLocal8Bit().data(), username.toLocal8Bit().data());
 }
 
+void Greeter::changeAuthentication(const QString &service)
+{
+    Q_D(Greeter);
+    lightdm_greeter_change_authentication(d->ldmGreeter, service.toLocal8Bit().data());
+}
+
 void Greeter::respond(const QString &response)
 {
     Q_D(Greeter);

=== modified file 'src/greeter.c'
--- src/greeter.c	2014-09-29 23:42:38 +0000
+++ src/greeter.c	2014-10-02 07:53:03 +0000
@@ -40,6 +40,9 @@
     gchar *pam_service;
     gchar *autologin_pam_service;
 
+    /* PAM services to that are triggered by external events */
+    gchar **passive_services;
+
     /* Buffer for data read from greeter */
     guint8 *read_buffer;
     gsize n_read;
@@ -63,6 +66,9 @@
     /* PAM session being constructed by the greeter */
     Session *authentication_session;
 
+    /* Background sessions being authenticated by the greeter */
+    GList *passive_sessions;
+
     /* TRUE if a the greeter can handle a reset; else we will just kill it instead */
     gboolean resettable;
 
@@ -95,6 +101,7 @@
     GREETER_MESSAGE_SET_LANGUAGE,
     GREETER_MESSAGE_AUTHENTICATE_REMOTE,
     GREETER_MESSAGE_ENSURE_SHARED_DIR,
+    GREETER_MESSAGE_CHANGE_AUTHENTICATION,
 } GreeterMessage;
 
 /* Messages from the server to the greeter */
@@ -107,6 +114,7 @@
     SERVER_MESSAGE_SHARED_DIR_RESULT,
     SERVER_MESSAGE_IDLE,
     SERVER_MESSAGE_RESET,
+    SERVER_MESSAGE_OFFER_AUTHENTICATION,
 } ServerMessage;
 
 static gboolean read_cb (GIOChannel *source, GIOCondition condition, gpointer data);
@@ -118,12 +126,13 @@
 }
 
 void
-greeter_set_pam_services (Greeter *greeter, const gchar *pam_service, const gchar *autologin_pam_service)
+greeter_set_pam_services (Greeter *greeter, const gchar *pam_service, const gchar *autologin_pam_service, gchar **passive_services)
 {
     g_free (greeter->priv->pam_service);
     greeter->priv->pam_service = g_strdup (pam_service);
     g_free (greeter->priv->autologin_pam_service);
     greeter->priv->autologin_pam_service = g_strdup (autologin_pam_service);
+    greeter->priv->passive_services = g_strdupv (passive_services);
 }
 
 void
@@ -258,6 +267,33 @@
 }
 
 static void
+offer_service (Greeter *greeter, const gchar *service)
+{
+    guint8 message[MAX_MESSAGE_LENGTH];
+    gsize offset = 0;
+    guint32 length;
+
+    g_debug ("Greeter offering authentication with service %s", service);
+
+    length = string_length (service);
+    write_header (message, MAX_MESSAGE_LENGTH, SERVER_MESSAGE_OFFER_AUTHENTICATION, length, &offset);
+    write_string (message, MAX_MESSAGE_LENGTH, service, &offset);
+    write_message (greeter, message, offset);
+}
+
+static void
+passive_messages_cb (Session *session, Greeter *greeter)
+{
+    offer_service (greeter, session_get_pam_service (session));
+}
+
+static void
+passive_complete_cb (Session *session, Greeter *greeter)
+{
+    offer_service (greeter, session_get_pam_service (session));
+}
+
+static void
 handle_connect (Greeter *greeter, const gchar *version, gboolean resettable)
 {
     guint8 message[MAX_MESSAGE_LENGTH];
@@ -265,6 +301,7 @@
     guint32 length;
     GHashTableIter iter;
     gpointer key, value;
+    int i;
 
     l_debug (greeter, "Greeter connected version=%s resettable=%s", version, resettable ? "true" : "false");
 
@@ -285,6 +322,24 @@
     }
     write_message (greeter, message, offset);
 
+    /* Start background authentications */
+    if (greeter->priv->passive_services)
+    {
+        for (i = 0; greeter->priv->passive_services[i]; i++)
+        {
+            Session *session;
+
+            g_signal_emit (greeter, signals[CREATE_SESSION], 0, &session);
+            greeter->priv->passive_sessions = g_list_append (greeter->priv->passive_sessions, session);
+            g_signal_connect (G_OBJECT (session), "got-messages", G_CALLBACK (passive_messages_cb), greeter);
+            g_signal_connect (G_OBJECT (session), "authentication-complete", G_CALLBACK (passive_complete_cb), greeter);
+            session_set_pam_service (session, greeter->priv->passive_services[i]);
+            session_set_do_authenticate (session, TRUE);
+            session_set_is_interactive (session, TRUE);
+            session_start (session);
+        }
+    }
+
     g_signal_emit (greeter, signals[CONNECTED], 0);
 }
 
@@ -572,6 +627,45 @@
 }
 
 static void
+handle_change_authentication (Greeter *greeter, guint32 sequence_number, const gchar *service)
+{
+    Session *session = NULL;
+    GList *link;
+
+    g_debug ("Greeter change authentication to service %s", service);
+
+    /* Find this session */
+    for (link = greeter->priv->passive_sessions; link; link = link->next)
+    {
+        Session *s = link->data;
+        if (strcmp (service, session_get_pam_service (s)) == 0)
+        {
+            session = s;
+            break;
+        }
+    }
+    if (session == NULL)
+    {
+        g_warning ("Greeter requested unknown service %s", service);
+        return;
+    }
+
+    reset_session (greeter);
+
+    greeter->priv->authentication_sequence_number = sequence_number;
+  
+    /* Listen to this new service */
+    greeter->priv->authentication_session = g_object_ref (session);
+    g_signal_handlers_disconnect_matched (session, G_SIGNAL_MATCH_DATA, 0, 0, NULL, NULL, greeter);
+    g_signal_connect (G_OBJECT (session), "got-messages", G_CALLBACK (pam_messages_cb), greeter);
+    g_signal_connect (G_OBJECT (session), "authentication-complete", G_CALLBACK (authentication_complete_cb), greeter);
+    if (session_get_is_authentication_complete (session))
+        authentication_complete_cb (session, greeter);
+    else
+        pam_messages_cb (session, greeter);
+}
+
+static void
 handle_continue_authentication (Greeter *greeter, gchar **secrets)
 {
     int messages_length;
@@ -790,7 +884,7 @@
     GIOStatus status;
     int id, length, i;
     guint32 sequence_number, n_secrets, max_secrets;
-    gchar *version, *username, *session_name, *language;
+    gchar *version, *username, *session_name, *language, *service;
     gchar **secrets;
     gboolean resettable = FALSE;
     GError *error = NULL;
@@ -868,6 +962,12 @@
         username = read_string (greeter, &offset);
         handle_login_remote (greeter, session_name, username, sequence_number);
         break;
+    case GREETER_MESSAGE_CHANGE_AUTHENTICATION:
+        sequence_number = read_int (greeter, &offset);
+        service = read_string (greeter, &offset);
+        handle_change_authentication (greeter, sequence_number, service);
+        g_free (service);
+        break;
     case GREETER_MESSAGE_CONTINUE_AUTHENTICATION:
         n_secrets = read_int (greeter, &offset);
         max_secrets = (G_MAXUINT32 - 1) / sizeof (gchar *);
@@ -1035,11 +1135,13 @@
 greeter_finalize (GObject *object)
 {
     Greeter *self;
+    GList *link;
 
     self = GREETER (object);
 
     g_free (self->priv->pam_service);
     g_free (self->priv->autologin_pam_service);
+    g_strfreev (self->priv->passive_services);
     secure_free (self, self->priv->read_buffer);
     g_hash_table_unref (self->priv->hints);
     g_free (self->priv->remote_session);
@@ -1049,6 +1151,13 @@
         g_signal_handlers_disconnect_matched (self->priv->authentication_session, G_SIGNAL_MATCH_DATA, 0, 0, NULL, NULL, self);
         g_object_unref (self->priv->authentication_session);
     }
+    for (link = self->priv->passive_sessions; link; link = link->next)
+    {
+        Session *session = link->data;
+        g_signal_handlers_disconnect_matched (session, G_SIGNAL_MATCH_DATA, 0, 0, NULL, NULL, self);
+        g_object_unref (session);
+    }
+    g_list_free (self->priv->passive_sessions);
     if (self->priv->to_greeter_channel)
         g_io_channel_unref (self->priv->to_greeter_channel);
     if (self->priv->from_greeter_channel)

=== modified file 'src/greeter.h'
--- src/greeter.h	2014-09-29 23:42:38 +0000
+++ src/greeter.h	2014-10-02 07:53:03 +0000
@@ -50,7 +50,7 @@
 
 Greeter *greeter_new (void);
 
-void greeter_set_pam_services (Greeter *greeter, const gchar *pam_service, const gchar *autologin_pam_service);
+void greeter_set_pam_services (Greeter *greeter, const gchar *pam_service, const gchar *autologin_pam_service, gchar **passive_services);
 
 void greeter_set_allow_guest (Greeter *greeter, gboolean allow_guest);
 

=== modified file 'src/seat.c'
--- src/seat.c	2014-09-29 23:42:38 +0000
+++ src/seat.c	2014-10-02 07:53:03 +0000
@@ -1186,7 +1186,8 @@
     gchar *sessions_dir, **argv;
     SessionConfig *session_config;
     Greeter *greeter_session;
-    const gchar *greeter_wrapper;
+    const gchar *greeter_wrapper, *service_list;
+    gchar **passive_services;
     const gchar *autologin_username;
     int autologin_timeout;
     gboolean autologin_guest;
@@ -1235,9 +1236,14 @@
     session_set_argv (SESSION (greeter_session), argv);
     g_strfreev (argv);
 
+    service_list = seat_get_string_property (seat, "passive-services");
+    passive_services = service_list ? g_strsplit (service_list, " ", -1) : NULL;
     greeter_set_pam_services (greeter_session,
                               seat_get_string_property (seat, "pam-service"),
-                              seat_get_string_property (seat, "pam-autologin-service"));
+                              seat_get_string_property (seat, "pam-autologin-service"),
+                              passive_services);
+    g_strfreev (passive_services);
+    greeter_set_allow_guest (greeter_session, seat_get_allow_guest (seat));
     g_signal_connect (greeter_session, GREETER_SIGNAL_CREATE_SESSION, G_CALLBACK (greeter_create_session_cb), seat);
     g_signal_connect (greeter_session, GREETER_SIGNAL_START_SESSION, G_CALLBACK (greeter_start_session_cb), seat);
 

=== modified file 'src/session.c'
--- src/session.c	2014-09-29 23:42:38 +0000
+++ src/session.c	2014-10-02 07:53:03 +0000
@@ -646,6 +646,13 @@
 }
 
 const gchar *
+session_get_pam_service (Session *session)
+{
+    g_return_val_if_fail (session != NULL, NULL);
+    return session->priv->pam_service;
+}
+
+const gchar *
 session_get_username (Session *session)
 {
     g_return_val_if_fail (session != NULL, NULL);
@@ -706,6 +713,13 @@
 }
 
 gboolean
+session_get_is_authentication_complete (Session *session)
+{
+    g_return_val_if_fail (session != NULL, FALSE);
+    return session->priv->authentication_complete;
+}
+
+gboolean
 session_get_is_authenticated (Session *session)
 {
     g_return_val_if_fail (session != NULL, FALSE);

=== modified file 'src/session.h'
--- src/session.h	2014-09-29 23:42:38 +0000
+++ src/session.h	2014-10-02 07:53:03 +0000
@@ -74,6 +74,8 @@
 
 void session_set_pam_service (Session *session, const gchar *pam_service);
 
+const gchar *session_get_pam_service (Session *session);
+
 void session_set_username (Session *session, const gchar *username);
 
 void session_set_do_authenticate (Session *session, gboolean do_authenticate);
@@ -125,6 +127,8 @@
 
 const struct pam_message *session_get_messages (Session *session);
 
+gboolean session_get_is_authentication_complete (Session *session);
+
 gboolean session_get_is_authenticated (Session *session);
 
 int session_get_authentication_result (Session *session);

=== modified file 'tests/Makefile.am'
--- tests/Makefile.am	2014-10-02 06:51:36 +0000
+++ tests/Makefile.am	2014-10-02 07:53:03 +0000
@@ -36,6 +36,8 @@
 	test-autologin-guest-timeout-gobject \
 	test-change-authentication \
 	test-restart-authentication \
+	test-fingerprint \
+	test-smartcard \
 	test-cancel-authentication-gobject \
 	test-login-pam \
 	test-login-pam-config \
@@ -387,6 +389,7 @@
 	scripts/dbus.conf \
 	scripts/denied.conf \
 	scripts/expired.conf \
+	scripts/fingerprint.conf \
 	scripts/greeter-allow-guest.conf \
 	scripts/greeter-crash.conf \
 	scripts/greeter-default-session.conf \
@@ -491,6 +494,8 @@
 	scripts/session-stderr.conf \
 	scripts/session-stderr-multi-write.conf \
 	scripts/session-stderr-backup.conf \
+	scripts/smartcard.conf \
+	scripts/surfaceflinger-autologin.conf \
 	scripts/switch-to-greeter.conf \
 	scripts/switch-to-greeter-disabled.conf \
 	scripts/switch-to-greeter-new-session.conf \

=== added file 'tests/scripts/fingerprint.conf'
--- tests/scripts/fingerprint.conf	1970-01-01 00:00:00 +0000
+++ tests/scripts/fingerprint.conf	2014-10-02 07:53:03 +0000
@@ -0,0 +1,38 @@
+#
+# Check can handle a fingerprint user than then requires a password
+#
+
+[SeatDefaults]
+passive-services=lightdm-fingerprint
+
+#?*START-DAEMON
+#?RUNNER DAEMON-START
+
+# X server starts
+#?XSERVER-0 START VT=7 SEAT=seat0
+
+# Daemon connects when X server is ready
+#?*XSERVER-0 INDICATE-READY
+#?XSERVER-0 INDICATE-READY
+#?XSERVER-0 ACCEPT-CONNECT
+
+# Greeter starts
+#?GREETER-X-0 START XDG_SEAT=seat0 XDG_VTNR=7 XDG_SESSION_CLASS=greeter
+#?LOGIN1 ACTIVATE-SESSION SESSION=c0
+#?XSERVER-0 ACCEPT-CONNECT
+#?GREETER-X-0 CONNECT-XSERVER
+#?GREETER-X-0 CONNECT-TO-DAEMON
+#?GREETER-X-0 CONNECTED-TO-DAEMON
+
+# Greeter is offered an authentication
+#?GREETER-X-0 OFFER-AUTHENTICATION SERVICE=lightdm-fingerprint
+#?*GREETER-X-0 CHANGE-AUTHENTICATION SERVICE=lightdm-fingerprint
+#?GREETER-X-0 SHOW-PROMPT TEXT="Password:"
+#?*GREETER-X-0 RESPOND TEXT="password"
+#?GREETER-X-0 AUTHENTICATION-COMPLETE USERNAME=fingerprint AUTHENTICATED=TRUE
+
+# Cleanup
+#?*STOP-DAEMON
+#?GREETER-X-0 TERMINATE SIGNAL=15
+#?XSERVER-0 TERMINATE SIGNAL=15
+#?RUNNER DAEMON-EXIT STATUS=0

=== added file 'tests/scripts/smartcard.conf'
--- tests/scripts/smartcard.conf	1970-01-01 00:00:00 +0000
+++ tests/scripts/smartcard.conf	2014-10-02 07:53:03 +0000
@@ -0,0 +1,36 @@
+#
+# Check can handle a smartcard user that authorizes without any additional input
+#
+
+[SeatDefaults]
+passive-services=lightdm-smartcard
+
+#?*START-DAEMON
+#?RUNNER DAEMON-START
+
+# X server starts
+#?XSERVER-0 START VT=7 SEAT=seat0
+
+# Daemon connects when X server is ready
+#?*XSERVER-0 INDICATE-READY
+#?XSERVER-0 INDICATE-READY
+#?XSERVER-0 ACCEPT-CONNECT
+
+# Greeter starts
+#?GREETER-X-0 START XDG_SEAT=seat0 XDG_VTNR=7 XDG_SESSION_CLASS=greeter
+#?LOGIN1 ACTIVATE-SESSION SESSION=c0
+#?XSERVER-0 ACCEPT-CONNECT
+#?GREETER-X-0 CONNECT-XSERVER
+#?GREETER-X-0 CONNECT-TO-DAEMON
+#?GREETER-X-0 CONNECTED-TO-DAEMON
+
+# Greeter is offered an authentication
+#?GREETER-X-0 OFFER-AUTHENTICATION SERVICE=lightdm-smartcard
+#?*GREETER-X-0 CHANGE-AUTHENTICATION SERVICE=lightdm-smartcard
+#?GREETER-X-0 AUTHENTICATION-COMPLETE USERNAME=smartcard AUTHENTICATED=TRUE
+
+# Cleanup
+#?*STOP-DAEMON
+#?GREETER-X-0 TERMINATE SIGNAL=15
+#?XSERVER-0 TERMINATE SIGNAL=15
+#?RUNNER DAEMON-EXIT STATUS=0

=== modified file 'tests/src/libsystem.c'
--- tests/src/libsystem.c	2014-09-19 03:16:14 +0000
+++ tests/src/libsystem.c	2014-10-02 07:53:03 +0000
@@ -910,6 +910,44 @@
             return PAM_AUTH_ERR;
     }
 
+    /* Fingerprint user scans immediately and requires password */
+    if (strcmp (pamh->service_name, "lightdm-fingerprint") == 0)
+    {
+        int result;
+        struct pam_message **msg;
+        struct pam_response *resp = NULL;
+
+        msg = malloc (sizeof (struct pam_message *) * 1);
+
+        if (pamh->user)
+            free (pamh->user);
+        pamh->user = strdup ("fingerprint");
+
+        entry = getpwnam (pamh->user);
+        msg = malloc (sizeof (struct pam_message *));      
+        msg[0] = malloc (sizeof (struct pam_message));
+        msg[0]->msg_style = PAM_PROMPT_ECHO_OFF;
+        msg[0]->msg = "Password:";
+        result = pamh->conversation.conv (1, (const struct pam_message **) msg, &resp, pamh->conversation.appdata_ptr);
+        free (msg[0]);
+        free (msg);
+        password_matches = strcmp (entry->pw_passwd, resp[0].resp) == 0;
+        if (resp[0].resp)
+            free (resp[0].resp);
+        free (resp);
+
+        return password_matches ? PAM_SUCCESS : PAM_AUTH_ERR;
+    }
+
+    /* Smartcard user scans immediately */
+    if (strcmp (pamh->service_name, "lightdm-smartcard") == 0)
+    {
+        if (pamh->user)
+            free (pamh->user);
+        pamh->user = strdup ("smartcard");
+        return PAM_SUCCESS;
+    }
+
     /* Prompt for username */
     if (pamh->user == NULL)
     {

=== modified file 'tests/src/test-gobject-greeter.c'
--- tests/src/test-gobject-greeter.c	2014-09-29 23:42:38 +0000
+++ tests/src/test-gobject-greeter.c	2014-10-02 07:53:03 +0000
@@ -44,6 +44,12 @@
 }
 
 static void
+offer_authentication_cb (LightDMGreeter *greeter, const gchar *service)
+{
+    status_notify ("%s OFFER-AUTHENTICATION SERVICE=%s", greeter_id, service);
+}
+
+static void
 autologin_timer_expired_cb (LightDMGreeter *greeter)
 {
 }
@@ -209,6 +215,9 @@
     else if (strcmp (name, "RESPOND") == 0)
         lightdm_greeter_respond (greeter, g_hash_table_lookup (params, "TEXT"));
 
+    else if (strcmp (name, "CHANGE-AUTHENTICATION") == 0)
+        lightdm_greeter_change_authentication (greeter, g_hash_table_lookup (params, "SERVICE"));
+
     else if (strcmp (name, "CANCEL-AUTHENTICATION") == 0)
         lightdm_greeter_cancel_authentication (greeter);
 
@@ -485,6 +494,7 @@
     g_signal_connect (greeter, LIGHTDM_GREETER_SIGNAL_SHOW_MESSAGE, G_CALLBACK (show_message_cb), NULL);
     g_signal_connect (greeter, LIGHTDM_GREETER_SIGNAL_SHOW_PROMPT, G_CALLBACK (show_prompt_cb), NULL);
     g_signal_connect (greeter, LIGHTDM_GREETER_SIGNAL_AUTHENTICATION_COMPLETE, G_CALLBACK (authentication_complete_cb), NULL);
+    g_signal_connect (greeter, LIGHTDM_GREETER_SIGNAL_OFFER_AUTHENTICATION, G_CALLBACK (offer_authentication_cb), NULL);
     g_signal_connect (greeter, LIGHTDM_GREETER_SIGNAL_AUTOLOGIN_TIMER_EXPIRED, G_CALLBACK (autologin_timer_expired_cb), NULL);
     if (g_key_file_get_boolean (config, "test-greeter-config", "resettable", NULL))
     {

=== modified file 'tests/src/test-runner.c'
--- tests/src/test-runner.c	2014-10-02 02:46:13 +0000
+++ tests/src/test-runner.c	2014-10-02 07:53:03 +0000
@@ -2723,6 +2723,10 @@
         {"corrupt-xauth",    "password",  "Corrupt Xauthority", 1032},
         /* User to test properties */
         {"prop-user",        "",          "TEST",               1033},
+        /* This account is the user that starts by scanning a fingerprint then requiring a password */
+        {"fingerprint",      "password",  "Fingerprint",        1034},
+        /* This account is the user that authenticates by scanning a smartcard */
+        {"smartcard",        "password",  "Smartcard",          1035},
         {NULL,               NULL,        NULL,                    0}
     };
     passwd_data = g_string_new ("");

=== added file 'tests/test-fingerprint'
--- tests/test-fingerprint	1970-01-01 00:00:00 +0000
+++ tests/test-fingerprint	2014-10-02 07:53:03 +0000
@@ -0,0 +1,2 @@
+#!/bin/sh
+./src/dbus-env ./src/test-runner fingerprint test-gobject-greeter

=== added file 'tests/test-smartcard'
--- tests/test-smartcard	1970-01-01 00:00:00 +0000
+++ tests/test-smartcard	2014-10-02 07:53:03 +0000
@@ -0,0 +1,2 @@
+#!/bin/sh
+./src/dbus-env ./src/test-runner smartcard test-gobject-greeter