Currently PAM_ERROR_MSG and PAM_TEXT_INFO are logged but not surfaced to the user. Any failure mode (expired password, faillock, ...) are just shown as "authentication failed". Side note: PAM_TEXT_INFO can also carry a message on successful authentication, e.g. "your password will expire in 3 days".
Fix: return the PAM message in the existing "fail:" response to the greeter. A message on success needs special handling in the greeter (e.g. a dismissable popup or a delay).
Currently
PAM_ERROR_MSGandPAM_TEXT_INFOare logged but not surfaced to the user. Any failure mode (expired password, faillock, ...) are just shown as "authentication failed". Side note:PAM_TEXT_INFOcan also carry a message on successful authentication, e.g. "your password will expire in 3 days".Fix: return the PAM message in the existing "fail:" response to the greeter. A message on success needs special handling in the greeter (e.g. a dismissable popup or a delay).