Change:
GDM's PAM modules are currently built so that the password stack of the keyring PAM module get loaded before a password input module is loaded, which results in the keyring never being unlocked automatically. in with GDM to use an application that has its password stored in GNOME keyring will ask you for the unlock password System: (Flounder) Nix version: nix-env (Nix) 1.11.4 Nixpkgs version: 16.09.1465.
Relevant discussion on unified PAM settings
Same with LightDM.
Automatic GNOME keyring unlocking with LightDM is fixed in NixOS 18.03, but GDM still does not unlock the keyring...
I wonder if this is resolved after
If it is a PAM thing, I do not thinks so. We did not touch PAM.

Discussion:
"password sufficient ${pam_krb5}/lib/security/pam_krb5.so use_first_pass"} ${optionalString config.services.samba.syncPasswordsByPam "password optional ${pkgs.samba}/lib/security/pam_smbpass.so nullok use_authtok try_first_pass"} <ins> ${optionalString cfg.enableGnomeKeyring "password optional ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so use_authtok"} </ins> # Session management. ${optionalString cfg.setEnvironment ''

services.dbus.packages = [ pkgs.gnome3.gnome-keyring pkgs.gcr ]; <ins> security.pam.services.login.enableGnomeKeyring = true; </ins> }; }

session  optional       pam_permit.so ''; <del> gdm.text = '' auth     requisite      pam_nologin.so auth     required       pam_env.so envfile=${config.system.build.pamEnvironment} auth     required       pam_succeed_if.so uid >= 1000 quiet auth     optional       ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so auth     ${if config.security.pam.enableEcryptfs then "required" else "sufficient"} pam_unix.so nullok likeauth ${optionalString config.security.pam.enableEcryptfs "auth required ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap"} ${optionalString (! config.security.pam.enableEcryptfs) "auth     required       pam_deny.so"} account  sufficient     pam_unix.so password requisite      pam_unix.so nullok sha512 ${optionalString config.security.pam.enableEcryptfs "password optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"} session  required       pam_env.so envfile=${config.system.build.pamEnvironment} session  required       pam_unix.so ${optionalString config.security.pam.enableEcryptfs "session optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"} session  required       pam_loginuid.so session  optional       ${pkgs.systemd}/lib/security/pam_systemd.so session  optional       ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start ''; </del> gdm-password.text = '' <del> auth     requisite      pam_nologin.so auth     required       pam_env.so envfile=${config.system.build.pamEnvironment} auth     required       pam_succeed_if.so uid >= 1000 quiet auth     optional       ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so auth     ${if config.security.pam.enableEcryptfs then "required" else "sufficient"} pam_unix.so nullok likeauth ${optionalString config.security.pam.enableEcryptfs "auth required ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap"} ${optionalString (! config.security.pam.enableEcryptfs) "auth     required       pam_deny.so"} account  sufficient     pam_unix.so password requisite      pam_unix.so nullok sha512 ${optionalString config.security.pam.enableEcryptfs "password optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"} session  required       pam_env.so envfile=${config.system.build.pamEnvironment} session  required       pam_unix.so ${optionalString config.security.pam.enableEcryptfs "session optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"} session  required       pam_loginuid.so session  optional       ${pkgs.systemd}/lib/security/pam_systemd.so session  optional       ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start </del> <ins> auth      substack      login account   include       login password  substack      login session   include       login </ins> ''; gdm-autologin.text = '' <del> auth     requisite      pam_nologin.so </del> <ins> auth      requisite     pam_nologin.so </ins> <del> auth     required       pam_succeed_if.so uid >= 1000 quiet auth     required       pam_permit.so </del> <ins> auth      required      pam_succeed_if.so uid >= 1000 quiet auth      required      pam_permit.so </ins> <del> account  sufficient     pam_unix.so </del> <ins> account   sufficient    pam_unix.so </ins> <del> password requisite      pam_unix.so nullok sha512 </del> <ins> password  requisite     pam_unix.so nullok sha512 </ins> <del> session  optional       pam_keyinit.so revoke session  required       pam_env.so envfile=${config.system.build.pamEnvironment} session  required       pam_unix.so session  required       pam_loginuid.so session  optional       ${pkgs.systemd}/lib/security/pam_systemd.so </del> <ins> session   optional      pam_keyinit.so revoke session   include       login </ins> ''; };