"Unlock with system authentication" broken

[Sharparam]

Steps To Reproduce

1. Uninstall and clean system of any Bitwarden files
2. Install Bitwarden desktop (pacman -S bitwarden) (also tested with Flatpak which doesn't work either)
3. Install polkit policy manually
4. Launch it
5. Log in
6. Open settings and enable "Unlock with system authentication"
7. Lock
8. Try to unlock with system authentication
9. KDE shows authentication pop up
10. Bitwarden does nothing after it succeeds

Manual polkit policy saved at /usr/share/polkit-1/actions/com.bitwarden.Bitwarden.policy:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
 "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
 "http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">

<policyconfig>
    <action id="com.bitwarden.Bitwarden.unlock">
      <description>Unlock Bitwarden</description>
      <message>Authenticate to unlock Bitwarden</message>
      <defaults>
        <allow_any>no</allow_any>
        <allow_inactive>no</allow_inactive>
        <allow_active>auth_self</allow_active>
      </defaults>
    </action>
</policyconfig>

(Taken from https://github.com/bitwarden/clients/blob/main/apps/desktop/src/key-management/biometrics/os-biometrics-linux.service.ts#L14C23-L31)

Expected Result

Bitwarden desktop can be unlocked with system authentication.

Actual Result

Nothing happens after the system authentication dialog from KDE.

Screenshots or Videos

No response

Additional Context

Downgrading Bitwarden desktop to version 2024.12.1 makes it work again.

So something happened between 2024.12.1 and 2025.1.3.

(A previous edit had this as 2024.9.0, but I tested again with the release that was actually before the newest one and that also worked.)

Here are the logs from the new version from starting the desktop client and trying to login/lock/unlock/enable system auth:

❯ bitwarden-desktop
23:52:18.276 › No state version found, assuming empty state.
23:52:18.386 › Coredumps are disabled in renderer process
23:52:19.066 › State version: 69
23:52:19.385 › Retrieving application id
[SSH Agent Native Module] BITWARDEN_SSH_AUTH_SOCK not set, using default path
[SSH Agent Native Module] Starting SSH Agent server on "/home/sharparam/.bitwarden-ssh-agent.sock"
[SSH Agent Native Module] Could not remove existing socket file: No such file or directory (os error 2)
23:52:19.389 › SSH agent started
23:54:19.073 › Retrieving application id
23:54:29.049 › Retrieving application id
23:54:35.541 › Active account changed, clearing SSH keys
falling back to get legacy Bitwarden <GUID>_accessTokenKey
23:54:35.593 › Error: no result
23:54:35.597 › Error: DBus error service error org.freedesktop.Secret.Error.IsLocked: no description
falling back to get legacy Bitwarden <GUID>_accessTokenKey
23:54:35.602 › Error: no result
23:54:35.602 › SetAccessToken: storing encrypted access token in secure storage failed. Falling back to disk storage. Error: New Access token key unable to be retrieved from secure storage.
23:54:35.607 › Error: DBus error service error org.freedesktop.Secret.Error.IsLocked: no description
falling back to get legacy Bitwarden <GUID>_refreshToken
23:54:35.612 › Error: no result
23:54:35.612 › SetRefreshToken: storing refresh token in secure storage failed. Falling back to disk storage. Error: Refresh token failed to save to secure storage.
falling back to get legacy Bitwarden <GUID>_accessTokenKey
23:54:35.623 › Error: no result
falling back to get legacy Bitwarden <GUID>_accessTokenKey
23:54:35.640 › Error: no result
falling back to get legacy Bitwarden <GUID>_accessTokenKey
23:54:35.646 › Error: no result
falling back to get legacy Bitwarden <GUID>_accessTokenKey
23:54:35.655 › Error: no result
falling back to get legacy Bitwarden <GUID>_accessTokenKey
23:54:35.660 › Error: no result
falling back to get legacy Bitwarden <GUID>_accessTokenKey
falling back to get legacy Bitwarden <GUID>_accessTokenKey
23:54:35.666 › Error: no result
23:54:35.666 › Error: no result
falling back to get legacy Bitwarden <GUID>_accessTokenKey
23:54:35.673 › Error: no result
falling back to get legacy Bitwarden <GUID>_accessTokenKey
23:54:35.680 › Error: no result
falling back to get legacy Bitwarden <GUID>_accessTokenKey
23:54:35.868 › Error: no result
23:54:35.871 › Finished search indexing
23:54:35.872 › Error: DBus error service error org.freedesktop.Secret.Error.IsLocked: no description
falling back to get legacy Bitwarden <GUID>_accessTokenKey
23:54:35.878 › Error: no result
23:54:35.878 › SetAccessToken: storing encrypted access token in secure storage failed. Falling back to disk storage. Error: New Access token key unable to be retrieved from secure storage.
23:54:35.882 › Error: DBus error service error org.freedesktop.Secret.Error.IsLocked: no description
falling back to get legacy Bitwarden <GUID>_refreshToken
23:54:35.888 › Error: no result
23:54:35.888 › SetRefreshToken: storing refresh token in secure storage failed. Falling back to disk storage. Error: Refresh token failed to save to secure storage.
falling back to get legacy Bitwarden <GUID>_accessTokenKey
23:54:35.895 › Error: no result
falling back to get legacy Bitwarden <GUID>_accessTokenKey
23:54:35.900 › Error: no result
falling back to get legacy Bitwarden <GUID>_accessTokenKey
23:54:36.837 › Error: no result
23:54:37.025 › Starting decryption using multithreading with 8 workers for <count> items
23:54:37.153 › Finished decrypting <count> items using 8 workers
23:54:37.241 › Finished search indexing
00:01:58.857 › Retrieving application id
falling back to get legacy Bitwarden <GUID>_accessTokenKey
00:01:58.866 › Error: no result
falling back to get legacy Bitwarden <GUID>_accessTokenKey
00:01:58.877 › Error: no result
falling back to get legacy Bitwarden <GUID>_accessTokenKey
00:01:58.904 › Error: no result
falling back to get legacy Bitwarden <GUID>_accessTokenKey
00:01:58.909 › Error: no result
00:01:59.125 › Starting decryption using multithreading with 8 workers for <count> items
00:01:59.242 › Finished decrypting <count> items using 8 workers
00:01:59.355 › Finished search indexing
00:02:44.062 › Retrieving application id
falling back to get legacy Bitwarden <GUID>_accessTokenKey
00:02:44.072 › Error: no result
falling back to get legacy Bitwarden <GUID>_accessTokenKey
00:02:44.085 › Error: no result
falling back to get legacy Bitwarden <GUID>_accessTokenKey
00:02:44.122 › Error: no result
falling back to get legacy Bitwarden <GUID>_accessTokenKey
00:02:44.127 › Error: no result
00:02:44.679 › Starting decryption using multithreading with 8 workers for <count> items
00:02:44.736 › Finished decrypting <count> items using 8 workers
00:02:44.831 › Finished search indexing

(I replaced GUIDs with <GUID> since I wasn't sure if they are sensitive or not.)

Operating System

Linux

Operating System Version

Arch Linux melina 6.12.10-zen1-1-zen #1 ZEN SMP PREEMPT_DYNAMIC Sat, 18 Jan 2025 02:26:52 +0000 x86_64 GNU/Linux

Installation method

Other

Build Version

2025.1.3

Issue Tracking Info

• I understand that work is tracked outside of GitHub. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

[bitwarden-bot]

Thank you for reporting this issue! We've added this to our internal tracking system.
ID: PM-17895

[quexten]

Hi! First note: The arch distribution is a community-maintained distribution and unsupported. Still, this seems like a more general bug.

From the logs, it seems like the issue is that your secret service is locked. Could you see what happens when you unlock kwallet manually, and then try to set up biometrics again?

[jimmielightner]

My KDEWallet is unlocked and I experience the same behavior as @Sharparam.

I manually closed and then re-opened my wallet. I also noticed there are multiple entries for BitWarden - is this expected?

[Sharparam]

@quexten Yeah I gathered as much when looking at the official download links, but I also tested with the Flatpak package which I think is official (https://bitwarden.com/download/)? (Although not sure if the Flatpak version is supposed to support system auth to begin with.)

The wallet/secret service has been unlocked the whole time, as far as I can tell. kdewallet is in the "open" state when inspecting with the wallet manager, and given that the older version of Bitwarden (2024.12.1) can access it just fine, that shouldn't be the issue? I'm also able to interact with it via secret-tool.

At work we also use 1Password, which also has a system auth integration, and that continues to work.

[quexten]

I also noticed there are multiple entries for BitWarden - is this expected?

At least this is expected, yes. There are at least entries for:

• Access token
• Refresh token
• Biometric unlock secret

I'm not sure about the other behavior.

[detiam]

Same issue, maybe related to #11900?
Also, I'm on kde5, which uses kwallet5 that doesn't support XDG Secrets Portal.

[Sharparam]

@quexten I applied the fix mentioned here: #8651 (comment)

And after doing this, using system authentication now works again on the latest version of Bitwarden desktop in the Arch repos (2025.1.3).

As the link in the comment shows, this fix is from the Arch wiki page on KDE Wallet.

So this is maybe not actually a Bitwarden issue after all, but the required actions to make it work is maybe worth mentioning in Bitwarden documentation somewhere (probably the page on biometrics), or when activating the option in the app.

There is still an error logged from the desktop app:

01:00:21.578 › Native messaging server started at: /home/sharparam/.cache/com.bitwarden.desktop/app.bitwarden
01:00:21.585 › Microsoft Edge not found, skipping.
01:00:21.931 › State version: 69
[SSH Agent Native Module] BITWARDEN_SSH_AUTH_SOCK not set, using default path
[SSH Agent Native Module] Starting SSH Agent server on "/home/sharparam/.bitwarden-ssh-agent.sock"
01:00:21.938 › SSH agent started
falling back to get legacy Bitwarden_auto <GUID>_user_auto
01:00:21.943 › Error: no result
01:00:44.274 › Error: DBus error service error org.freedesktop.zbus.Error: Client public key size is invalid
01:00:44.554 › Starting decryption using multithreading with 8 workers for <count> items
01:00:44.679 › Finished decrypting <count> items using 8 workers
01:00:44.795 › Finished search indexing
01:01:04.355 › Unhandled error in angular Error: Cannot read properties of null (reading 'filter')
01:01:04.396 › Reloading render process
[69234:0207/010104.399673:FATAL:child_thread_impl.cc(362)] Crashing because hung
01:01:04.474 › Render process reloaded
01:01:04.805 › State version: 69
falling back to get legacy Bitwarden_auto <GUID>_user_auto
01:01:04.816 › Error: no result
01:01:07.750 › Starting decryption using multithreading with 8 workers for 730 items
01:01:07.885 › Finished decrypting <count> items using 8 workers
01:01:08.000 › Finished search indexing

As far as I can tell though, the app still functions as expected.

@jimmielightner Can you test the same fix and see if it works for you as well? (Making sure you also have the polkit policy set up.)

[detiam]

For me, #12760 AppImage resolves the issue.

[jimmielightner]

@Sharparam I applied the fix and rebooted but still receive:

Feb 07 10:20:29 archxps polkit-kde-authentication-agent-1[1665]: Listener adapter polkit_qt_listener_initiate_authentication
Feb 07 10:20:29 archxps polkit-kde-authentication-agent-1[1665]: GSimpleAsyncResult: 0x7e931c004410
Feb 07 10:20:29 archxps polkit-kde-authentication-agent-1[1665]: polkit_qt_listener_initiate_authentication callback for  0x563f82f073c0
Feb 07 10:20:29 archxps polkit-kde-authentication-agent-1[1665]: Initiating authentication
Feb 07 10:20:29 archxps polkit-kde-authentication-agent-1[1665]: Action description has been found
Feb 07 10:20:29 archxps polkit-kde-authentication-agent-1[1665]: User:  "unix-user:jimmie"
Feb 07 10:20:29 archxps polkit-kde-authentication-agent-1[1665]: Trying again
Feb 07 10:20:29 archxps kwin_wayland[1429]: kwin_core: Cannot grant a token to KWin::ClientConnection(0x5a2445fea280)
Feb 07 10:20:29 archxps systemd[1]: Starting Fingerprint Authentication Daemon...
Feb 07 10:20:30 archxps kernel: usb 3-9: reset full-speed USB device number 3 using xhci_hcd
Feb 07 10:20:30 archxps systemd[1]: Started Fingerprint Authentication Daemon.
Feb 07 10:20:30 archxps kernel: usb 3-9: reset full-speed USB device number 3 using xhci_hcd
Feb 07 10:20:30 archxps polkit-kde-authentication-agent-1[1665]: showInfo
Feb 07 10:20:30 archxps polkit-kde-authentication-agent-1[1665]: Info:  "Place your finger on the fingerprint reader"
Feb 07 10:20:32 archxps polkit-kde-authentication-agent-1[1665]: COMPLETED
Feb 07 10:20:32 archxps polkit-kde-authentication-agent-1[1665]: Completed:  true
Feb 07 10:20:32 archxps polkit-kde-authentication-agent-1[1665]: Finishing obtaining privileges
Feb 07 10:20:32 archxps polkit-kde-authentication-agent-1[1665]: Listener adapter polkit_qt_listener_initiate_authentication_finish
Feb 07 10:20:32 archxps polkit-kde-authentication-agent-1[1665]: polkit_qt_listener_initiate_authentication_finish callback for  0x563f82f073c0
Feb 07 10:20:32 archxps polkit-kde-authentication-agent-1[1665]: Finish obtain authorization: true
Feb 07 10:20:32 archxps polkit-kde-authentication-agent-1[1665]: Dialog cancelled
Feb 07 10:20:32 archxps polkit-kde-authentication-agent-1[1665]: Finishing obtaining privileges
Feb 07 10:20:32 archxps polkit-kde-authentication-agent-1[1665]: Finish obtain authorization: true
Feb 07 10:20:32 archxps polkitd[738]: Operator of unix-session:2 successfully authenticated as unix-user:jimmie to gain ONE-SHOT authorization for action com.bitwarden.Bitwarden.unlock for unix-process:1926:5237 [/usr/lib/electron33/electron /usr/lib/bitwarden/app.asar] (owned by unix-user:jimmie)
Feb 07 10:20:32 archxps bitwarden-desktop[1926]: falling back to get legacy Bitwarden_biometric 4f3e101e-c23c-4fa7-833a-0be29d2bbc1a_user_biometric
Feb 07 10:20:32 archxps bitwarden-desktop[1926]: 10:20:32.533 › Error: no result

[Sharparam]

@jimmielightner Do you also have the polkit policy mentioned in the first post? Your errors seem a little different from the ones I had though. It has the same "falling back to get legacy..." and "Error: no result" but the stuff around it seems different.

[jimmielightner]

@Sharparam - Confirmed, I have the polkit policy in place. Not sure why our logs are so different.

I originally missed that you mentioned you downgraded bitwarden (2025.1.3-1 => 2024.12.1-1) and as you stated, all works for me on that version as well.

Feb 09 14:51:55 archxps polkit-kde-authentication-agent-1[1675]: Listener adapter polkit_qt_listener_initiate_authentication
Feb 09 14:51:55 archxps polkit-kde-authentication-agent-1[1675]: GSimpleAsyncResult: 0x7eeb940065b0
Feb 09 14:51:55 archxps polkit-kde-authentication-agent-1[1675]: polkit_qt_listener_initiate_authentication callback for  0x63f5d17c4590
Feb 09 14:51:55 archxps polkit-kde-authentication-agent-1[1675]: Initiating authentication
Feb 09 14:51:55 archxps polkit-kde-authentication-agent-1[1675]: Action description has been found
Feb 09 14:51:55 archxps polkit-kde-authentication-agent-1[1675]: User:  "unix-user:jimmie"
Feb 09 14:51:55 archxps polkit-kde-authentication-agent-1[1675]: Trying again
Feb 09 14:51:55 archxps systemd[1]: Starting Fingerprint Authentication Daemon...
Feb 09 14:51:55 archxps kernel: usb 3-9: reset full-speed USB device number 3 using xhci_hcd
Feb 09 14:51:55 archxps systemd[1]: Started Fingerprint Authentication Daemon.
Feb 09 14:51:55 archxps kernel: usb 3-9: reset full-speed USB device number 3 using xhci_hcd
Feb 09 14:51:55 archxps polkit-kde-authentication-agent-1[1675]: showInfo
Feb 09 14:51:55 archxps polkit-kde-authentication-agent-1[1675]: Info:  "Place your finger on the fingerprint reader"
Feb 09 14:51:57 archxps polkit-kde-authentication-agent-1[1675]: COMPLETED
Feb 09 14:51:57 archxps polkit-kde-authentication-agent-1[1675]: Completed:  true
Feb 09 14:51:57 archxps polkit-kde-authentication-agent-1[1675]: Finishing obtaining privileges
Feb 09 14:51:57 archxps polkit-kde-authentication-agent-1[1675]: Listener adapter polkit_qt_listener_initiate_authentication_finish
Feb 09 14:51:57 archxps polkitd[751]: Operator of unix-session:2 successfully authenticated as unix-user:jimmie to gain ONE-SHOT authorization for action com.bitwarden.Bitwarden.unlock for unix-process:60605:9732311 [/usr/lib/electron32/electron /usr/lib/bitwarden/app.asar] (owned by unix-user:jimmie)
Feb 09 14:51:57 archxps polkit-kde-authentication-agent-1[1675]: polkit_qt_listener_initiate_authentication_finish callback for  0x63f5d17c4590
Feb 09 14:51:57 archxps polkit-kde-authentication-agent-1[1675]: Finish obtain authorization: true
Feb 09 14:51:57 archxps polkit-kde-authentication-agent-1[1675]: Dialog cancelled
Feb 09 14:51:57 archxps polkit-kde-authentication-agent-1[1675]: Finishing obtaining privileges
Feb 09 14:51:57 archxps polkit-kde-authentication-agent-1[1675]: Finish obtain authorization: true
Feb 09 14:51:57 archxps bitwarden-desktop[60605]: 14:51:57.765 › Starting decryption using multithreading
Feb 09 14:51:57 archxps bitwarden-desktop[60605]: 14:51:57.767 › Starting decryption using multithreading
Feb 09 14:51:57 archxps bitwarden-desktop[60605]: 14:51:57.938 › Finished search indexing
Feb 09 14:51:58 archxps bitwarden-desktop[61022]: libpng warning: iCCP: known incorrect sRGB profile
Feb 09 14:51:58 archxps bitwarden-desktop[61022]: libpng warning: iCCP: known incorrect sRGB profile
Feb 09 14:51:58 archxps bitwarden-desktop[61022]: libpng warning: iCCP: known incorrect sRGB profile
Feb 09 14:52:02 archxps bitwarden-desktop[60605]: 14:52:02.673 › Skipping sync wait, continuing to unlock.
Feb 09 14:52:27 archxps systemd[1]: fprintd.service: Deactivated successfully.