vorlon said this in a message. It really sounds like
the right approach. We should make simplepamapps' login
work like this.
Unless we're talking again about the 'login -f' case,
and the problem is
that you have a single PAM config being used both with
and without
pam_authenticate(). Honestly, I don't think this can
be made to work reliably
without seriously botching things for other
applications. login needs to have
two different configurations, with two different
service names, because the
configuration requirements when pam_authenticate() is
used are different than
those when it is not used.