41

I am running a fresh install of CentOS 7 GNOME so I could RDP from Windows.  I followed the “Connect to GNOME desktop environment via XRDP” instructions, but when I connect I get an additional login that says

authentication is required to create a color profile

How do I remove this additional login?

In an attempt to solve this problem I tried a solution at “Griffon's IT Library”, but it did not work because link is a lot more then just a solution to this problem.  I pasted the solution below.

When you login into your system via remote session, you will see this message popping up.  You can simply cancel and you will be able to proceed till the next time you login and start a new session.

To avoid this prompt, we will need to change the polkit configuration.  Using admin privileges, create a file called 02-allow-colord.conf under the following directory /etc/polkit-1/localauthority.conf.d/

The file should contains [sic] the following instructions and you should not be prompted anymore with such authentication request while remoting into your system

polkit.addRule(function(action, subject) {
   if ((action.id == “org.freedesktop.color-manager.create-device”  ||
        action.id == “org.freedesktop.color-manager.create-profile” ||
        action.id == “org.freedesktop.color-manager.delete-device”  ||
        action.id == “org.freedesktop.color-manager.delete-profile” ||
        action.id == “org.freedesktop.color-manager.modify-device”  ||
        action.id == “org.freedesktop.color-manager.modify-profile”)  &&
        subject.isInGroup(“{group}”)) {
           return polkit.Result.YES;
   }
});
5
  • I have the same issue here, I'm running a centos7.5.1804. I'm using the xrdp, and if I select xvnc, I don't see this dialog, but if I select xorg, I do see the annoying dialog.
    – ollydbg23
    Jul 26, 2018 at 6:31
  • If anyone wanna know more : Blog which explains it nicely
    – HarshaD
    Nov 30, 2020 at 18:08
  • It's damn annoying that it asks you 3 times for your password every single time you want to use RDP after closing your laptop. Feb 19, 2022 at 22:16
  • The same issues seems to be triggered in Ubuntu 22.04 after installing Chrome Remote Desktop. The most upvoted answer works in that case as well
    – apokryfos
    May 16, 2023 at 7:16
  • why are you using unicode “ instead of "
    – Rainb
    Feb 4 at 21:38

7 Answers 7

53

I had the same problem and found a different work-around here:

https://github.com/TurboVNC/turbovnc/issues/47#issuecomment-412005377

This variant is claimed to work independent of authentication scheme (e.g. LDAP).

Create /etc/polkit-1/localauthority/50-local.d/color.pkla (note: .pkla extension is required) with the following contents:

[Allow colord for all users]
Identity=unix-user:*
Action=org.freedesktop.color-manager.create-device;org.freedesktop.color-manager.create-profile;org.freedesktop.color-manager.delete-device;org.freedesktop.color-manager.delete-profile;org.freedesktop.color-manager.modify-device;org.freedesktop.color-manager.modify-profile;org.freedesktop.packagekit.system-sources-refresh
ResultAny=yes
ResultInactive=yes
ResultActive=yes

Worked for me.

update
See next comment in linked github thread... 18.04 users may want to try the above answer but with the following changes:

[Allow colord for all users]
Identity=unix-user:*
Action=org.freedesktop.color-manager.create-device;org.freedesktop.color-manager.create-profile;org.freedesktop.color-manager.delete-device;org.freedesktop.color-manager.delete-profile;org.freedesktop.color-manager.modify-device;org.freedesktop.color-manager.modify-profile;org.freedesktop.packagekit.system-sources-refresh
ResultAny=no
ResultInactive=no
ResultActive=yes
9
  • 4
    Worked for me as well (Ubuntu 18.04). Accepted answer didn't work for me (perhaps I did something wrong). Hmm, perhaps I spoke/wrote too soon. Connection was soon dropped and when I reconnect it drops soon after connect. Remove the file and looks like I can connect again (but with the original issue).
    – ds00424
    Feb 12, 2019 at 21:56
  • 1
    worked for me on ubuntu 20.04
    – realgt
    May 26, 2020 at 15:31
  • 11
    The key has to do with PolKit version. If your system uses PolKit < 0.106, then you will need a .pkla file as opposed to a .conf file. You can find out the version of PolKit you have by running pkaction --version command. On Ubuntu 20.04, I got pkaction version 0.105. Reference: http://c-nergy.be/blog/?p=12043. Jun 25, 2020 at 4:31
  • 1
    This worked for me as opposed to the accepted answer. pkaction --version returns 0.115
    – Ex Umbris
    Jul 25, 2020 at 22:50
  • 1
    This worked for me with settings ResultAny=no and ResultInactive=no
    – 2cents
    Jan 15, 2021 at 17:56
21

EDIT:

Please use the upvoted answer and not this one.

OLD ANSWER:

I found this bug and some workarounds here:

https://bugzilla.redhat.com/show_bug.cgi?id=1149893

More specific you have to place a .rules file in

/etc/polkit-1/rules.d/

(Select a filename and just givr the .rules extension)

and give the rules:

polkit.addRule(function(action, subject) {
   if ((action.id == "org.freedesktop.color-manager.create-device" ||
        action.id == "org.freedesktop.color-manager.create-profile" ||
        action.id == "org.freedesktop.color-manager.delete-device" ||
        action.id == "org.freedesktop.color-manager.delete-profile" ||
        action.id == "org.freedesktop.color-manager.modify-device" ||
        action.id == "org.freedesktop.color-manager.modify-profile") &&
       subject.isInGroup("ATTENTION")) {
      return polkit.Result.YES;
   }
});

Then you have to Replace the word "ATTENTION" with your user's group.

9
  • 1
    With the changes mentioned above, I can workaround this issue. Thanks.
    – ollydbg23
    Jul 26, 2018 at 6:52
  • 1
    Great answer; thanks for including the references. This worked for me on Fedora 28, connecting with VNC.
    – Dogweather
    Sep 11, 2018 at 22:10
  • 2
    I also had to restart polkit to load the new rule file (i.e. systemctl restart polkit). Rebooting should also work.
    – nochkin
    May 3, 2019 at 13:17
  • 1
    After this "fix" the restart/shutdown from the power icon at top right no longer prompts for a password and does nothing.
    – Ex Umbris
    Dec 14, 2021 at 19:38
  • 1
    Yes, that works. In the interests of future visitors, it would be generous to ask the OP (@Starblight) to change the accept checkmark to Nemo's answer.
    – Ex Umbris
    Dec 14, 2021 at 19:54
5

None of the other two answers worked for me, so I used a more drastic proposal to simply disallow changing the colour profile:

Ok I edited /usr/share/polkit-1/actions/org.freedesktop.color.policy, changed every instance of "auth_admin" to "no"

I used the following little bash snippet to do this:

cd /usr/share/polkit-1/actions/
cp -a  org.freedesktop.color.policy  org.freedesktop.color.policy.orig
sed -e 's|>auth_admin<|>no<|g'  org.freedesktop.color.policy.orig  >  org.freedesktop.color.policy
3
  • this stopped that popup when using VNC, on RHEL 7.8 x86-64. Other proposed solutions were not working
    – ron
    Aug 18, 2020 at 15:18
  • can you, or anyone, quickly elaborate on what the ramifications would be changing the <allow_any>auth_admin</allow_any> to <allow_any>no</allow_any> in this file?
    – ron
    Aug 18, 2020 at 15:20
  • @ron sorry I'm not an expert on policy files, so pleas take this with a huge grain of salt: Reading between the lines in the bug thread I think it simply does not allow changing the colour profile. Another comment in that thread appears to be doing the opposite, allowing a specific group to change the profile, eliminating the authentication prompt.
    – FriendFX
    Aug 19, 2020 at 2:20
4

I'm running Windows 10 Remote Desktop Connection to Ubuntu 18.04.4 LTS with xrdp. The following solution from this page worked for me (see section titled How to "fix" this issue):

  • delete the file org.freedesktop.color.policy file (located in /usr/share/polkit-1/actions). By deleting this file, you are basically removing the limitations of creating and managing color devices and profiles.

Note that the above is one of two 'not recommended' ways. However, for my little home lab setup, it worked fine with no undesirable side effects that I can see. There are two other recommended solutions that I did not try.

3

Another way to fix it:

sudo sed -i 's/<allow_inactive>no</<allow_inactive>yes</' /usr/share/polkit-1/actions/org.freedesktop.color.policy
sudo sed -i 's/<allow_any>.*</<allow_any>yes</' /usr/share/polkit-1/actions/org.freedesktop.color.policy

Taken from here: https://wiki.xorde.co/en/recipes/ubuntu-share-screen

2
  • This works. I wish every system administration issue was this simple. Apr 15, 2022 at 2:51
  • systemctl restart xrdp.service to check that it works. Apr 15, 2022 at 2:51
0

For me, the solution worked after change ResultAny and ResultInactive to "no", like Cecilia comment's in the same aswer. My connection drop if i try to authenticate, but remain after cancel. I'm running Windows 7 RDP to Ubuntu 18.04 with Xrdp.

[Allow colord for all users]
Identity=unix-user:*
Action=org.freedesktop.color-manager.create-device;org.freedesktop.color-manager.create-profile;org.freedesktop.color-manager.delete-device;org.freedesktop.color-manager.delete-profile;org.freedesktop.color-manager.modify-device;org.freedesktop.color-manager.modify-profile
ResultAny=no
ResultInactive=no
ResultActive=yes
0

I kept running into this "Authentication is Required to ...." issue over and over for every little thing when logging in through VNC or xRDP, etc. Creating the .pkla file described above resolved it for that error. I was creating a new .pkla file for each specific error. Finally, I found that this universal pkla file resolved all such errors:

  1. Create a file named "universal.pkla" (or anything as long as it ends in .pkla) in the directory:
    /etc/polkit-1/localauthority/50-local.d/

  2. These are the contents of universal.pkla:
    [Allow access to anything for remote users]
    Identity=unix-user:*
    Action=*
    ResultAny=yes
    ResultInactive=yes
    ResultActive=yes

  3. Then restart polkit with "sudo systemctl restart polkit.service" or reboot.

2
  • Your answer is for your own error which is different.
    – number9
    Jun 29, 2022 at 17:15
  • @number9: actually, it's the same problem. The fundamental issue is that users logged in remotely are treated differently.
    – EML
    Jul 4, 2023 at 8:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .