Noratek BLOG

GNOME keeps asking to unlock the Login keyring after fingerprint login (Fedora)

Published 14 June 2026

date
env
linux Fedora 44 (GNOME) macos N/A
tags

Symptom

When logging into the laptop with the fingerprint reader, GNOME pops up one or two dialogs asking for your account password to unlock the login keyring. Logging in with the password instead does not show these dialogs.

Root cause — a known GNOME limitation (not a bug to “fix”)

The GNOME “Login” keyring is encrypted with your account password. Normally, the PAM module pam_gnome_keyring grabs that password as you type it at login and uses it to auto-unlock the keyring.

A fingerprint proves your identity but never reveals a password. So:

  • The PAM stack for fingerprint login (/etc/pam.d/gdm-fingerprint) contains no pam_gnome_keyring (unlike gdm-password) — and even if it did, it would have no password to decrypt the keyring with.
  • Result: the keyring stays locked, and GNOME must ask you to unlock it manually the first time a secret is needed (Wi-Fi, stored tokens, SSH key in gcr, etc.).

This is an acknowledged GNOME limitation, not a Fedora bug. A Fedora moderator’s summary: “we have to wait for the GNOME fix, there won’t be any workaround probably.” There is no official fix at this time.

Remove the password on the “Login” keyring so it auto-unlocks at session start regardless of how you authenticated. This is the documented community workaround.

⚠️ Prerequisite / security warning — REQUIRES FULL-DISK ENCRYPTION (LUKS)

An empty keyring password means the stored secrets are no longer encrypted at rest — they are protected only by file permissions. This is only acceptable if your disk is encrypted with LUKS, so the keyring file is still protected at rest by full-disk encryption.

Verify your disk is LUKS-encrypted first:

Terminal window
lsblk -o NAME,FSTYPE,MOUNTPOINTS | grep -i crypt
# Expect a line like:
#   nvme0n1p3                        crypto_LUKS
#     luks-...                       btrfs   /home

The keyring lives at ~/.local/share/keyrings/login.keyring (under /home), so if /home is on LUKS, the secrets remain encrypted at rest. If you do NOT have LUKS, do not do this — keep the password prompts instead.

Steps (GNOME in English)

  1. Install Seahorse if missing:
    Terminal window
    sudo dnf install -y seahorse
  2. Open Passwords and Keys (Seahorse).
  3. Left panel, under Passwords → right-click the Login keyring → Change Password.
  4. Old password = your account password. New password = leave empty (both fields blank).
  5. Confirm the warning (“store unencrypted” / Use Unsafe Storage).
  6. Log out and log back in with the fingerprint → the unlock dialogs are gone.

Verify it was applied

The keyring file is rewritten when the password changes — its modification time should jump to “now”:

Terminal window
ls -l --time-style=+%H:%M:%S ~/.local/share/keyrings/login.keyring

Alternatives (if you do NOT want an empty keyring password)

  • Log in with your password (use the fingerprint only for sudo / unlocking the screen) — keeps the keyring encrypted, no prompts.
  • Live with the prompt — unlock the keyring once per session when asked.

Sources