1. Since GNOME Settings seems to depend on #AuthSelect (at least on #fedora), ensure that it is running, using your preferred profile (e.g., in my case `local`) and fingerprint auth is generally enabled: `sudo authselect select local && sudo authselect enable-feature with-fingerprint`
2. Enroll your fingerprint in GNOME Settings -> System -> Users
3. Now, disable authselect since it cannot distinguish b/w loggin in and other types of authentication and otherwise #GDM #gSettings will complain that "the key is not writable" :( `sudo authselect opt-out`
4. Remove the line pertaining enable-fingerprint-authentication from the #dconf lock in `/etc/dconf/db/distro.d/locks/20-authselect`
5. Recompile dconf: `sudo dconf update`
6. Finally, configure GDM to not use fingerprint authentication for your user: `gsettings set org.gnome.login-screen enable-fingerprint-authentication false`
7. Optionally (untested): Ensure that `dbus-launch` is installed and run `sudo -u gdm dbus-launch gsettings set org.gnome.login-screen enable-fingerprint-authentication false` to disable this system-wide.

Unfortunately, not only does authselect not distinguish b/w anything GDM related and other auth types, GDM doesn't distinguish b/w log-in and unlocking the screen(?) So this breaks fingerprint screen-unlock.

2/3

Four years later, and there is still no #ansible module for #authselect ... I don't understand the way #redhat is going with some configuration tools. Instead of making RHEL a first class citizen for Ansible, they added fancy CLI's that don't integrate with configuration management. And please don't tell me to use Ansible's shell or command module  

#sysadmin #devops