As a user, I want to login to my workstation when LLNG server is unreachable

[guimard]

User Story

As a desktop user,
I want to login to my workstation when the LLNG server is unreachable,
So that I can work even without network connectivity.

Acceptance Criteria

• First login (online): SSO + create local password
• Subsequent logins (offline): Use local password
• Credentials cached securely with encryption
• Cache has configurable expiration
• Clear indication of offline mode to user

Technical Details

Architecture

First Login (ONLINE):
User → Greeter → PAM → LLNG Server ✓
                  ↓
         Create local password
                  ↓
         Cache encrypted credentials

Subsequent Login (OFFLINE):
User → Greeter → PAM → LLNG Server ✗ (timeout)
                  ↓
         Verify local password
                  ↓
         Decrypt cached user info
                  ↓
         Session opens

Security Model

• Password hashed with Argon2id (memory-hard)
• User data encrypted with AES-256-GCM
• Encryption key derived from password via PBKDF2
• Cache expires after configurable period (default: 7 days)

Component

Repo: llng-pam-module (C)