В /etc/pam.d/gdm-smartcard из коробки указано использование pam_pkcs11:
# cat /etc/pam.d/gdm-smartcard
#%PAM-1.0
auth        required    pam_shells.so
auth        required    pam_succeed_if.so quiet uid ne 0
auth        sufficient    pam_succeed_if.so user ingroup nopasswdlogin
auth        required    pam_pkcs11.so wait_for_card card_only
auth        optional    pam_gnome_keyring.so
account        include        system-auth-pkcs11
password    include        system-auth-pkcs11
password    required    pam_pkcs11.so
password    optional    pam_gnome_keyring.so use_authtok
session        substack    common-login
session        optional    pam_console.so
session        required    pam_namespace.so
session        optional    pam_gnome_keyring.so auto_start

При этом pam_pkcs11 из коробки не настроен и аутентификация по токену не может быть пройдена. GDM выдает ошибку:
Error 2304: PKCS#11 module could not be initialized.

Более подробно - https://my.basealt.space/issues/173763
Один из возможных воркэраундов - https://my.basealt.space/issues/173763#note-1 :
# diff /etc/pam.d/gdm-smartcard-default /etc/pam.d/gdm-smartcard
5c5
< auth        required    pam_pkcs11.so wait_for_card card_only
---
> auth        substack    common-login
7,9c7,8
< account        include        system-auth-pkcs11
< password    include        system-auth-pkcs11
< password    required    pam_pkcs11.so
---
> account        include        common-login
> password    include        common-login