Quartz 4

Switching to GNOME Keyring in KDE

4 min read

Important

This does not work because many apps use the desktop environment to decide which store to talk to instead of using the bus. This results in the change being largely ignored.

This is a comprehensive guide. It assumes you are running a standard Linux distribution (Arch, Fedora, Debian/Ubuntu based).

Guide

Part 1: The Backup (Crucial)

Since Timeshift does not back up your home directory secrets, we must do this manually.

1. Create a System Snapshot (Timeshift) Open Timeshift and create a new Snapshot. Label it “Before Secret Service Migration”.

2. Create a User Data Backup Open your terminal. We will archive your KWallet data, your GNOME Keyring data (if any exists), and the configs for the apps likely to be affected (Chrome, VS Code).

Note: I am excluding cache folders to keep the file size small.

# Create a backup directory
mkdir -p ~/migration_backup
 
# Archive your secrets and app configs
tar -czvf ~/migration_backup/secrets_and_configs.tar.gz \
  --ignore-failed-read \
  ~/.local/share/kwalletd \
  ~/.config/kwalletrc \
  ~/.local/share/keyrings \
  ~/.config/google-chrome/Default/Login\ Data \
  ~/.config/Code/User/globalStorage \
  ~/.config/1Password

Part 2: The Migration

Step 1: Install GNOME Keyring

Install the necessary packages.

  • Arch: sudo pacman -S gnome-keyring libsecret seahorse
  • Debian/Ubuntu: sudo apt install gnome-keyring libsecret-1-0 seahorse
  • Fedora: sudo dnf install gnome-keyring seahorse

Step 2: Disable KWallet’s Secret Service

We want KWallet to keep working for KDE internal tasks (like WiFi), but stop handling the org.freedesktop.secrets API.

  1. Open the config file:
nano ~/.config/kwalletrc
  1. Add (or modify) the following section at the bottom of the file:
[org.freedesktop.secrets]
apiEnabled=false
  1. Save and exit (Ctrl+O, Enter, Ctrl+X).

Step 3: Enable GNOME Keyring in KDE

We need to ensure KDE starts the GNOME daemon on login.

  1. Copy the autostart
cp /etc/xdg/autostart/gnome-keyring-secrets.desktop ~/.config/autostart/
  1. Edit the file to remove the line OnlyShowIn=GNOME;Unity;MATE;Cinnamon;
v ~/.config/autostart/gnome-keyring-secrets.desktop

Step 4: Verify PAM (Auto-unlocking)

This ensures you don’t have to type a password to unlock the keyring.

  1. Open /etc/pam.d/login (or /etc/pam.d/sddm if it exists). 
    cat /etc/pam.d/login
  2. Look for lines containing pam_gnome_keyring.so.
    • If you see them, you are good.
    • If you do not see them, you need to add them. Use sudo nano /etc/pam.d/login and add this at the end of the auth section and session section:
    auth       optional     pam_gnome_keyring.so
session    optional     pam_gnome_keyring.so auto_start

Step 5: Reboot and Verify

Restart your computer and log into KDE.

  1. Open a terminal.
  2. Run this command to check who owns the secrets service: 
    dbus-send --session --print-reply --dest=org.freedesktop.DBus \
  /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner \
  string:org.freedesktop.secrets
  3. Result Check:
    • If the reply gives a string like "string :1.75", It works.
    • To be 100% sure it’s GNOME Keyring, run ps aux | grep gnome-keyring and check if the daemon is running.

Step 6: Re-authenticate Apps

  1. Open 1Password. It will ask for your Master Password. Enter it. It should now sync with GNOME Keyring. Close 1Password and reopen it—it should now ask for Biometrics/PIN (or whatever quick unlock you set).
  2. Open VS Code. You will likely see a “Sync Turned Off” warning. Click it and sign in to GitHub.

Part 3: Setting up the Window Manager

Now that your backend is standardized, here is how you ensure it works when you switch to i3/Sway.

Add this to your WM startup config (e.g., ~/.config/i3/config or ~/.xinitrc):

# Start GNOME Keyring (if not already started by PAM)
exec --no-startup-id /usr/bin/gnome-keyring-daemon --start --components=secrets

Part 4: Restoration (The “Undo” Button)

If things are broken and you want to go back to KWallet completely:

1. Restore System Files (Optional but recommended) If you edited /etc/pam.d/login, undo those changes manually using sudo nano. If you are unsure what you changed, use Timeshift to restore the system snapshot you created in Part 1.

2. Reset User Configs

  1. Open a terminal.
  2. Kill the GNOME daemon: 
    killall gnome-keyring-daemon
  3. Restore your backup (This overwrites the current configs with your old ones): 
    tar -xzvf ~/migration_backup/secrets_and_configs.tar.gz -C /
    Note: The -C / ensures the files go back to their absolute paths in /home/user/...

3. Re-enable KWallet Secret Service If you didn’t run the tar command above, manually edit ~/.config/kwalletrc and remove the [org.freedesktop.secrets] section or set apiEnabled=true.

4. Reboot Restart your computer. KWallet will reclaim the bus, and your apps will find their old data (cookies, tokens) exactly where you left them.

Graph View

Backlinks