As a PAM module, I need offline fallback logic in pam_sm_authenticate

[guimard]

User Story

As the PAM module,
I need to implement offline fallback logic in pam_sm_authenticate,
So that authentication works when LLNG is unreachable.

Acceptance Criteria

• Config options: offline_enabled, offline_expiration, offline_timeout
• First login: after SSO success, prompt for local password creation
• Offline login: detect timeout, verify local password, decrypt cache
• Integrate with existing PAM flow
• Log offline authentication events

Technical Details

Config Options

auth required pam_llng.so \
    offline_enabled=true \
    offline_expiration=7d \
    offline_timeout=5 \
    offline_dir=/var/lib/pam_llng/offline \
    offline_min_password=8

Flow - First Login (Online)

pam_sm_authenticate():
1. Try LLNG authentication
2. If success:
   a. Check if offline cache exists
   b. If not, prompt "Create local password for offline access:"
   c. Validate password strength
   d. Hash with Argon2id, derive key with PBKDF2
   e. Encrypt user_info with AES-256-GCM
   f. Write cache file
3. Return PAM_SUCCESS

Flow - Offline Login

pam_sm_authenticate():
1. Try LLNG authentication
2. If timeout/network error:
   a. Check offline_enabled
   b. Check if cache exists for username
   c. Check cache not expired
   d. Get local password from user
   e. Hash with Argon2id, compare to stored hash
   f. If match, derive key, decrypt user_info
   g. Store info in PAM context
3. Return PAM_SUCCESS or PAM_AUTH_ERR

Files to Modify

• include/config.h: offline_* options
• src/config.c: parse offline options
• src/pam_llng.c: offline logic in pam_sm_authenticate

Component

Repo: llng-pam-module (C)