Change:
session  optional       pam_permit.so ''; <del> gdm.text = '' auth     requisite      pam_nologin.so auth     required       pam_env.so envfile=${config.system.build.pamEnvironment} auth     required       pam_succeed_if.so uid >= 1000 quiet auth     optional       ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so auth     ${if config.security.pam.enableEcryptfs then "required" else "sufficient"} pam_unix.so nullok likeauth ${optionalString config.security.pam.enableEcryptfs "auth required ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap"} ${optionalString (! config.security.pam.enableEcryptfs) "auth     required       pam_deny.so"} account  sufficient     pam_unix.so password requisite      pam_unix.so nullok sha512 ${optionalString config.security.pam.enableEcryptfs "password optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"} session  required       pam_env.so envfile=${config.system.build.pamEnvironment} session  required       pam_unix.so ${optionalString config.security.pam.enableEcryptfs "session optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"} session  required       pam_loginuid.so session  optional       ${pkgs.systemd}/lib/security/pam_systemd.so session  optional       ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start ''; </del> gdm-password.text = '' <del> auth     requisite      pam_nologin.so auth     required       pam_env.so envfile=${config.system.build.pamEnvironment} auth     required       pam_succeed_if.so uid >= 1000 quiet auth     optional       ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so auth     ${if config.security.pam.enableEcryptfs then "required" else "sufficient"} pam_unix.so nullok likeauth ${optionalString config.security.pam.enableEcryptfs "auth required ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap"} ${optionalString (! config.security.pam.enableEcryptfs) "auth     required       pam_deny.so"} account  sufficient     pam_unix.so password requisite      pam_unix.so nullok sha512 ${optionalString config.security.pam.enableEcryptfs "password optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"} session  required       pam_env.so envfile=${config.system.build.pamEnvironment} session  required       pam_unix.so ${optionalString config.security.pam.enableEcryptfs "session optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"} session  required       pam_loginuid.so session  optional       ${pkgs.systemd}/lib/security/pam_systemd.so session  optional       ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start </del> <ins> auth      substack      login account   include       login password  substack      login session   include       login </ins> ''; gdm-autologin.text = '' <del> auth     requisite      pam_nologin.so </del> <ins> auth      requisite     pam_nologin.so </ins> <del> auth     required       pam_succeed_if.so uid >= 1000 quiet auth     required       pam_permit.so </del> <ins> auth      required      pam_succeed_if.so uid >= 1000 quiet auth      required      pam_permit.so </ins> <del> account  sufficient     pam_unix.so </del> <ins> account   sufficient    pam_unix.so </ins> <del> password requisite      pam_unix.so nullok sha512 </del> <ins> password  requisite     pam_unix.so nullok sha512 </ins> <del> session  optional       pam_keyinit.so revoke session  required       pam_env.so envfile=${config.system.build.pamEnvironment} session  required       pam_unix.so session  required       pam_loginuid.so session  optional       ${pkgs.systemd}/lib/security/pam_systemd.so </del> <ins> session   optional      pam_keyinit.so revoke session   include       login </ins> ''; };

Discussion:
GDM's PAM modules are currently built so that the password stack of the keyring PAM module get loaded before a password input module is loaded, which results in the keyring never being unlocked automatically. in with GDM to use an application that has its password stored in GNOME keyring will ask you for the unlock password System: (Flounder) Nix version: nix-env (Nix) 1.11.4 Nixpkgs version: 16.09.1465.
Relevant discussion on unified PAM settings
Same with LightDM.
Automatic GNOME keyring unlocking with LightDM is fixed in NixOS 18.03, but GDM still does not unlock the keyring...
I wonder if this is resolved after
If it is a PAM thing, I do not thinks so. We did not touch PAM.

GDM currently uses custom PAM configuration that doesn't cover all items that are generated when is used, especially for sessions. As a result, logging in via GDM doesn't apply custom limits set via . custom limits that apply to the current user via out and back in again (via GDM) output output again, compare System: 16.09.1066. (Flounder) Nix version: nix-env (Nix) 1.11.4 Nixpkgs version: 16.09.1066.
Also facing this issue.
Closing in favor of open PR.