How can I enable the Touch ID prompt instead of system password for sudo when other apps allow touch?

Question

I'm running a fresh install of Sequoia, currently a macOS Sequoia 15.0.1 arm64 on MacBook Pro (14-inch, 2021) with Touch ID. I tried to enable Touch ID for sudo and the config files now look like:

cat /etc/pam.d/sudo
# sudo: auth account password session
auth       include        sudo_local
auth       sufficient     pam_smartcard.so
auth       required       pam_opendirectory.so
account    required       pam_permit.so
password   required       pam_deny.so
session    required       pam_permit.so

and

cat /etc/pam.d/sudo_local
# sudo_local: local config file which survives system update and is included for sudo
# uncomment following line to enable Touch ID for sudo
auth       sufficient     pam_tid.so

This does direct the authentication request to the system, instead of the Terminal password prompt. But now I get a system password prompt and not the desired Touch ID prompt.

Touch ID does work. Other prompts also require my fingerprint. This seems to be specific to the Terminal.

Any suggestions on how to solve this are welcome.

Update: This behaviour only happens when my MacBook is docked to my Dell USB display. One it's undocked everything works as expected...

Answer 1

So, turns out the DisplayLink drivers are messing things up. It seems like DisplayLink uses Apple ARD to present the extra display. And TouchID is blocked when ARD is active. This does make sense. But it's still annoying. Luckily Reddit came to the rescue:

/usr/bin/defaults write /Library/Preferences/com.apple.security.authorization.plist ignoreArd -bool TRUE