Limits: Handling PAM_NEW_AUTHTOK_REQD in zsh/pam

Goal

In a zsh script that authenticates users via the zsh/pam module, the script must detect when the user’s password has expired and prompt for a new one, all while keeping the least-privilege model intact.

Constraints & Uncertainty

The module exposes the return code PAM_NEW_AUTHTOK_REQD but does not provide a built‑in UI for the password‑change conversation. The script must supply a conversation function, yet the exact protocol for passing prompts, handling echo suppression, and ensuring the new password is accepted securely is not fully documented in the zsh manual. Additionally, it is unclear whether zsh/pam will automatically invoke the conversation callback or if the script must explicitly poll for the new password.

Unresolved Questions

1. When PAM_NEW_AUTHTOK_REQD is returned, does zsh/pam automatically trigger the conversation function, or must the script call pam_authenticate again with a new password?
2. What is the recommended pattern for implementing a conversation handler that securely prompts for a new password in a non‑interactive or headless environment?
3. Are there documented limits on the size of the prompt string or the number of conversation callbacks that zsh/pam can process?