12

I used to use auth sufficient pam_tid.so in the /private/etc/pam.d/sudo file to allow fingerprint authentification when using sudo command.

Recently upgraded my MBP for a new M1 under macOS Big Sur (11.1), and the change still works.

However, suddenly, this stopped working. Instead of asking for fingerprint, it asks me for password in the GUI (not in the terminal).

After digging around, I did a macOS recovery install and it resolved the problem.

Today, the problem appears again but the recovery install didn't fix it.

I just discovered that this only happens when my MBP is docked to my docking station with 4 external screens and hard drive. I need to understand what is causing this issue, I guess this may be related to the display link USB video driver.

Has anybody an idea on what's going wrong?

Improve this question
1
  • 1
    This also seems to happen when using Screen Sharing to extend the display on to an iPad or MacBook, but only when done wirelessly. It doesn't happen when extending the display to a tethered iPad.
    – RobM
    Commented Mar 30, 2022 at 13:19

3 Answers 3

Reset to default
11

I had reported something similar to Apple (in my case, I was experiencing this issue while using pam_tid and sudo while running a Screen Recording). They told me that currently, this is working as designed, but that there is a workaround available by running:

defaults write com.apple.security.authorization ignoreArd -bool TRUE

I am still unsure why this is designed this way in the first place, or what other effects this setting might have, as they did not elaborate other than to provide the workaround. I'm curious to know if this is also a suitable workaround for the DisplayLink issue or if it would only affect screen recordings, so please comment if you try it.

Improve this answer
2
  • Indeed, that works also. Thanks a lot ! It would be nice to know what are the other consequences of setting this param.
    – mperrin
    Commented Jul 23, 2022 at 9:14
  • This also fixes Touch ID problems when using Screen Sharing; the above sudo issue, but also cases where the Finder wants authentication for file moves. (If you're wondering "why would you use Touch ID on the remote computer being controlled through Screen Sharing, it is because I'm controlling a 2nd computer that is within arms reach.)
    – Michael Schmitt
    Commented Oct 24, 2022 at 22:40
3

Answer received from DisplayLink Support:

https://support.displaylink.com/forums/287786-displaylink-feature-suggestions/suggestions/42614770-bug-sudo-with-touchid-disabled-when-using-a-docke

Unfortunately we are aware of this problem but this is one of our driver limitations. At the moment we are unable to change it as it happens due to the way MacOS is treating our application/driver. In order to change that we would need Apple to change some options in their OS. I believe that in the future we will be able to resolve such issues but for now there is nothing that I can propose.

Improve this answer
2
  • This support issue is not available anymore (marked as private). Are you aware of any further info on the issue?
    – neu242
    Commented Mar 13, 2023 at 11:31
  • Nope, I am not a display link user anymore.
    – mperrin
    Commented Mar 22, 2023 at 10:48
1

If you are using this pam_tid with iTerm or tmux, there are additional steps you have to take for pam_tid to work. See https://apple.stackexchange.com/a/355880/513181 and my comment Can Touch ID on Mac authenticate sudo in Terminal? (in the accepted answer to the same question).

This problem is not solved by the default write ... command (which helps in other circumstances).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .