Version:            (using KDE KDE 3.5.4)
Installed from:    Gentoo Packages
Compiler:          gcc version 4.1.1 (Gentoo 4.1.1) i686-pc-linux-gnu
OS:                Linux

I use a slightly non-standard pam.d/sys-auth file to make tools like 'su' ask for a finger print instead of a password:

------------
auth       required     pam_env.so
auth       sufficient   pam_bioapi.so {...} /etc/bioapi/pam/
auth       sufficient   pam_unix.so likeauth nullok
auth       required     pam_deny.so

account    required     pam_unix.so

password   required     pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
password   sufficient   pam_bioapi.so {...} /etc/bioapi/pam/
password   sufficient   pam_unix.so nullok md5 shadow use_authtok
password   required     pam_deny.so

session    required     pam_limits.so
session    required     pam_unix.so
------------

Depending on whether DISPLAY is set (and xauth allows root to use my display), this makes su either
1) prompt for finger print authentication on the console:
---------
Verification start
Put finger
Image processing
Scanned good image
Operation succeeded
---------
2) pop up a window asking to swipe my finger over the reader. In this case, there's no console output at all.


Now a problem with KDESU arises because it's trying to run kdesu_stub with the desired privileges in order to find out if a password is needed. su does what it's supposed to, it asks for the finger print.

I swipe my finger and kdesu finds that no password is needed. Consequently, it goes on and starts the program with su, which asks for the finger print a second time.