Created attachment 184074 [details]
fingerprint.nix (almost working NixOS fingerprint configuration)

SUMMARY

kscreenlocker fails to authenticate using fingerprint (pam_fprintd) after system suspend/resume cycles. PAM module pam_fprintd is not invoked at all after resume, forcing password-only authentication.

STEPS TO REPRODUCE
1. Configure fingerprint authentication with pam_fprintd and verify it works with kscreenlocker (see attachment for a configuration for NixOS)
2. Lock the screen and confirm fingerprint authentication works normally
3. Suspend the system (or wait until it suspends automatically)
4. Wait more than a few minutes (it varies)
5. Resume 
6. Touch the fingerprint sensor


OBSERVED RESULT

After resume from suspend:
- kscreenlocker UI appears to offer fingerprint authentication
- pam_fprintd is never invoked (confirmed via system logs)
- Authentication attempts skip directly to pam_unix (password authentication)
- Only password authentication works until user session (or kscreenlocker_greet) restart

EXPECTED RESULT

Fingerprint authentication should continue working after suspend/resume cycles, with pam_fprintd being invoked normally as it was before suspend.

SOFTWARE/OS VERSIONS
Windows: N/A
macOS: N/A
Linux/KDE Plasma: NixOS 25.05
KDE Plasma Version: 6.3.6
KDE Frameworks Version: 6.14.0
Qt Version: 6.9.1

ADDITIONAL INFORMATION

kscreenlocker seems to establish its PAM session context at startup and does not reinitialize after resume. When fprintd restarts after resume (required for  USB device reinitialization), the existing kscreenlocker process retains a stale PAM session that cannot communicate with the restarted fprintd service.

System logs show:
- Before suspend: kscreenlocker_greet[PID]:  pam_fprintd(kde-fingerprint:auth): [normal fingerprint activity]
- After resume: kscreenlocker_greet[SAME_PID]: pam_unix(kde-fingerprint:auth): authentication failure
  (pam_fprintd never called)

Workaround:
1. Use password authentication
2. Add a system services that restarts the lockscreen greeter:
    pkill -TERM kscreenlocker_greet