gdm/util: Cleanup CredentialManager on successful verification

CredentialManagers emit a user-authenticated signal with a token
upon a successful authentication. This marks the service as preempting
and will be used for the next login/unlock request. However, the
preempting service is not cleaned after a successful verification.
As a consequence, it will be picked on a second unlock request.

This doesn't happen after a succesful login request because there
is a transition from the gnome-shell process owened by GDM to the
one owned by the user.

Clean the preempting service on a successful verification, like we
do when the PAM conversation stops.

Part-of: <https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/3291>

diff --git a/js/gdm/util.js b/js/gdm/util.js
index b5a544c8d6d6aab37083883c421d47a73d0bd3a6..07cc17a33b5b81dbfb1d76a4fd3ed746e6330d25 100644 (file)
--- a/js/gdm/util.js
+++ b/js/gdm/util.js
@@ -806,7 +806,14 @@ export class ShellUserVerifier extends Signals.EventEmitter {
         this.emit('reset');
     }
 
-    _onVerificationComplete() {
+    _onVerificationComplete(_client, serviceName) {
+        const isCredentialManager = !!this._credentialManagers[serviceName];
+        const isForeground = this.serviceIsForeground(serviceName);
+        if (isCredentialManager && isForeground) {
+            this._credentialManagers[serviceName].token = null;
+            this._preemptingService = null;
+        }
+
         this.emit('verification-complete');
     }