Is it possible to get Auto-Type working with local password managers in Bazzite?
As best I can tell, Bazzite with KDE Plasma is now strictly Wayland. When I tried to get a local password manager (KeepassXC) working, I found that Auto-Type did not work (it wasn’t even an option in the settings). I found references to a browser plugin to let KeepassXC do something similar to Auto-type in the browser, but since I also need passwords in local files and applications, that didn’t help. I also found references to setting an environment variable (QT_QPA_PLATFORM=xcb) in .bashrc. I thought that got things working, but after a reboot, the desktop was, essentially, gone: no taskbar, no system tray, no start button (sorry for the Windows-centric terminology). Removing that line from .bashrc fixed things. Since I think that line is supposed to set up an X11 server, I assume the Desktop going Tango Uniform with it means X11 just won’t run on Bazzite.
Is there, in fact, any way to actually get Auto-type working in Bazzite so a local password manager can work properly? Maybe I’m “holding it wrong” by trying to get Auto-type to work. Maybe there’s a better, more linux-centric or Wayland-centric way to do that. But, I couldn’t find it. I’d seen some references that someday, someone might come up with an API to allow password managers to securely communicate with browsers and other applications. But, even if that was in the works, it would be years before anything came of it. I’m not going to store my passwords (or some other equivalent) out in the cloud. I’m not going to store them in the various browsers I use. I need them for local files and applications as well as in browsers. Is there some solution I’m missing?
Well, it looks like I’ll be staying trapped on Windows for a while longer. I HAVE to have a password manager that works with multiple browsers, local applications and local files. I can’t understand why there isn’t more noise about this. Surely Bazzite users use password managers. And, surely, some of them have to be using local (i.e., non-cloud-based) password managers.
Maybe I’m wrong about getting KeepassXC set up. But, here’s a 7 year old, unsolved issue on their github page about it:
I think if you go to flatseal, search for keepassxc and scroll down to environment and there type in QT_QPA_PLATFORM=xcb you will get keepassxc running through xwayland (i think you can also just toggle off wayland and toggle on x11 in the same settings) . I think if you apply the same to your browser (via flatseal turn on x11 and turn off wayland) then you should be good to go. note that x11 is less “secure”, but it should work. I will qualify I haven’t tested it as I setup browser integration another way Installing 1Password in Bluefin, a better way? - #26 by jpl .
Sorry for the delay in getting back. I’d already uninstalled Bazzite and had to re-install it to test this. Adding QT_QPA_PLATFORM=xcb to the KeepassXC Environment Variable area in Flatseal got things (mostly) working. It looks like window titles/names aren’t getting communicated to KeepassXC, so auto-type isn’t really “auto.” I have to filter the auto-type popup window to narrow down the selection. But, once I do that, I can at least use the password manager. Not the best of all worlds, but usable. Adding the environment variable and the X11 fallback options to the Brave entry didn’t help.
Also unfortunately, it looks like Browser Integration doesn’t work with the flatpak versions of KeepassXC and browsers. I assume that’s because of the sandboxes.
Hopefully, the KDE Plasma people can get this Wayland-level inter-app communication working in the near future (from what I can find, it looks like the Wayland people don’t want to do it).
Thanks for the reply. I can at least continue working with Bazzite and see if it’ll work for me.
not sure how adventurous you are, but I think people have gotten flatpak keepassxc → flatpak browser working. It does escape the flatpak sandbox a little bit, but I use something similar for Bitwarden and for me having a working password manager > technically escaping the flatpak sandbox.
I was doing ok with the QT_QPA_PLATFORM=xcb “fix” to get Autotype semi-working in KeePassXC until the Bazzite upgrade from F43.20260217 to F43.2026030. Unfortunately, something in the latest Bazzite release (and it looks like it started up at the Fedora level and trickled down) rendered Autotype almost completely useless (it now randomly lower-cases some upper-case symbols). I took a look at the link @gghardwareissues posted and am completely lost. I’m going to have to research that quite a bit in the hope I can understand it at some point and get it working for my Flatpak Brave browser and my flatpak KeePassXC password manager.
And, in case anyone’s interested, here are the various bugs I filed about this (all closed: KeePassXC doesn’t care about “only broken on one distro” (i.e., Fedora and all its offspring), Bazzite (rightfully) points upstream to Fedora, and Fedora says they’re not messing with Autotype things until KeePassXC supports Qt 6 (I think that’s what they mean – they pointed to a KeePassXC WIP issue))
Been thinking about your situation…as I lurked your thread
Here is my take. Opinion, of course.
Wayland is not X11, and X11 is not Wayland.
As far as KeePassXC goes, it is up to the developers to make their software work within the design and limitations of the Wayland stack. If Wayland’s security model does not allow something like traditional X11-style Auto Type, then KeePassXC may simply not be able to offer that feature under Wayland. KeePassXC itself states that Auto Type on Linux works only in an X11 session, not Wayland.
That may suck for the KeePassXC developers and for users because it can mean losing a feature that previously worked under X11. But if the platform does not provide a supported way to implement it, then it simply is not going to happen.
A somewhat similar example is 1Password (which I use). If you install 1Password as a Flatpak, communication between the browser extension and the desktop app can break. That is due to Flatpak’s sandboxing limits. It may very well be that AgileBits cannot support that feature when 1Password is installed as a Flatpak. I’ve just made the decision to use the Flatpak and accept that browser plugin to app communication is broken. The only solution is running Firefox and 1Password out of Distrobox or building my own custom image. For my desktop, I’ve chosen to stay on the mainline Aurora image rather than do my own custom (which I do for other stuff) because I value the integration testing the Universal Blue team does, and once I build my own image, now I have to take on some of that responsibility.
Tradeoffs. Some things are simply not solvable in the same way they worked before. If a feature you rely on is critical, you have to decide what you value more: the platform, the application, or the specific feature. You may need to switch to another password manager or use a system that still supports X11.
From what I’ve been able to find, it looks like Autotype can’t work properly for any password manager. Wayland just doesn’t support the inter-app communication needed (and, apparently, won’t ever support it because of their security model). Everyone seems to be waiting for someone else (like KDE, I guess) to come up with a mechanism that will allow the needed inter-app communication in such a way that will work with Wayland (and possibly between flatpak sandboxes). I was mostly ok with that. But then this random lower-case thing happened.
I’ve been looking for other local, non-cloud password managers to try. But, really, the goto for Linux seems to be KeePassXC. I really don’t want to try a cloud-based password manager, but I’m starting to consider it. Of course, as you say, the inter-app communication problem exists there.
If I were to try a cloud-based password manager, I’m not sure which I’d try. The one I keep seeing recommended is Bitwarden. But, I’m wondering about Proton Pass since I already have access to it via my existing email subscription through them.
I’ve been using Proton Pass from almost right when they launched it. It has worked fine but I mostly just use it with my browser and with their extension.
There is a unofficial flatpak for the desktop app but it won’t really provide anything extra.
Maybe I need to get a bit more serious about changing my password manager from KeePassXC. The following regards Secure Blue instead of Universal Blue, but still…:
“On a related note: KeePassXC failed to upgrade to Qt 6 in 6 years: keepassxreboot/keepassxc#7774. Maybe makes sense to remove it from curated Bazaar apps with GNOME Secrets taking its place? It’s not as feature-rich as KeePassXC, but at least it doesn’t depend on an outdated framework.”
In case anyone’s looking for a script to set up the integration between KeePassXC (flatpak) and Brave (flatpak) on Bazzite (actually Kinoite – but since that’s also an atomic offshoot of Fedora, I figured it would work for Bazzite), I found this:
I did my best to look it over and compare it to other sources of manually configuring this and it seems good. It does seem to work.