As LLNG, I need a desktop login endpoint optimized for greeter iframe

[guimard]

User Story

As LLNG,
I need a desktop login endpoint optimized for the greeter iframe,
So that the authentication flow works smoothly in the LightDM context.

Acceptance Criteria

• Endpoint GET /desktop/login serves login page for greeter
• Page optimized for iframe display (minimal chrome)
• After authentication, sends postMessage to parent with token
• Token has limited scope (desktop auth only)
• Token is single-use

Technical Details

Endpoint

GET /desktop/login?client_id=desktop-greeter&redirect_uri=postmessage

Parameters

• client_id: OAuth2 client ID for desktop greeter
• redirect_uri: postmessage to indicate iframe communication

Post-Authentication Script

// After successful LLNG auth, send token to parent
window.parent.postMessage({
    type: 'llng_auth_success',
    access_token: '<generated_token>',
    username: '<authenticated_user>',
    expires_in: 300  // 5 minutes, single use
}, '*');

Security

• Token only valid for PAM authentication
• Token expires after first use
• CSP headers allow embedding in greeter only

Component

Repo: lemonldap-ng (Perl)
Files: Portal/Main/Desktop.pm (new)