This seems a bit fiddly.  Ordinarily this is the responsibility of PAM, `login`, and so on.  We're unlikely to do a good job of replicating that behavior.  Is there a way to delegate this work to whatever is configured on the local system?