Fingerprint auth in Linux works through PAM, there is pam_fprintd.so module which talks to fprintd service. When fprintd service isn't working, pam_fprintd fails to communicate with it, and PAM auth skips to the next module in the config. But another PAM module could also skip over pam_fprintd.
So suppose you have /etc/pam.d/system-auth with the following contents:
auth sufficient pam_fprintd.so
auth required pam_unix.so
Your real config could be different or even in a different location, but what's crucial is pam_fprintd and pam_unix, which does password auth.
What you could do is add another entry into config, just before pam_fprintd.so which would skip that module if LID is closed. One way to achieve this is via pam_exec.so module. Create an executable script /usr/local/bin/pam_check_lid with the following contents:
#!/bin/sh
LID_STATE=$(cat /proc/acpi/button/lid/LID/state | cut -d':' -f2 | tr -d ' ')
case ${LID_STATE} in
closed)
echo closed
exit 1
;;
open*)
echo open
exit 0
;;
*)
# LID is open by default
echo unknown
exit 0
;;
esac
IMPORTANT: ensure that this file isn't globally writable. Otherwise, you might introduce a security vulnerability into your system. Also, you can check LID status over dbus, for details check this.
And then add the following line, just before pam_fprintd:
auth [success=ignore default=1] pam_exec.so quiet /usr/local/bin/pam_check_lid
So your config would look like this:
auth [success=ignore default=1] pam_exec.so quiet /usr/local/bin/pam_check_lid
auth sufficient pam_fprintd.so
auth required pam_unix.so
Now PAM auth would execute your script before attempting fingerprint auth, and if your script returns non-zero exit code (fails) it would do the default action, which skips 1 entry in a PAM config (so it skips pam_fprintd to the next auth which is pam_unix). When LID is open, it will return 0 exit code, and on success it wouldn't do anything, because of the ignore keyword in a config.
Alternatively, instead of pam_exec.so with a script, you can make your own PAM module with the same behavior as a script.
Few notes on debugging and actually implementing this. If you're having issues with pam_exec, you can add debugging options like debug and log, for details check pam_exec documentation. It is also good to test your changes on a new PAM config, instead of modifying an existing one, since a mistake in a config might lock you from your account. For example, you can just copy your system-auth as system-auth-new and work on system-auth-new and then replace it when it's tested. And for testing you could use pamtester. For example:
cp /etc/pam.d/system-auth /etc/pam.d/system-auth-new
# UPDATE /etc/pam.d/system-auth-new
pamtester system-auth-new YOUR_USER_NAME authenticate
And when it works as intended, replace system-auth with your new config.
