Couldn't log in graphically. Now I can. Explanation?
 

Started up Debian and got the lightdm login screen as usual. It's the only one of my three systems that uses a graphical login. I entered my name and password and it said "wrong password". Well, maybe I mistyped it. But here's the weird thing: I tried again repeatedly with the correct password and couldn't get in.

I switched to a virtual console and logged in without any problems. So it has to be a problem with lightdm; my password hasn't got lost or anything. From my cli login, I was able get up an alternative desktop display by using startx.

I went back to the other display and decided to log in as root. Some dms won't let you do that but I found I was able to. Of course I typed the root password very carefully because I didn't want to get trapped in a similar loop. Up comes a root desktop with a funny wallpaper.

I logged out (which restarts the X-server of course), tried logging in as myself, and this time it worked. Now what actually happened there? Any ideas? My guess is that it has something to do with logind, because Debian uses systemd now.

Have you checked the log files? I'd start with /var/log/messages. (My copy of Debian has traditional log files, probably generated by rsyslog.)

If this is the first time you log in, it's possible your home directory did not exist (until you logged in on the command line)? I've seen desktop environments fail out so it just returns to the login screen, because the ~/.xfce4 or ~/.config/cinnamon or whatever it uses cannot be be created, and for some reason the mkdomedir didn't execute. I think it tends to be on systemd that I've seen.

No, it's a very old system (though I did recently upgrade it from Jessie to Stretch).

@frankbell: Lightdm makes its own log. Like the Xorg log, it isn't cumulative; you just get the most recent one and the one before. The recent log shows repeated authentication failures, so it must have been actively rejecting my (valid) password and not just stalled. I've copied both these logs for safety, since the in-situ versions will get overwritten.

The only way to test this is to deliberately use a bad password and see if the behaviour is reproducible. If it is, it's a bug and I shall report it. I meant to do it today, but my network card started playing up again and that took up most of my time.

It isn't reproducible. I deliberately logged in with a bad password just now, then gave the correct password and lightdm authenticated me at once. So if I did hit a bug, it was a much more subtle one.

Now that I come to think of it, such an obvious bug as a dm refusing to log you on after one bad password would surely have been picked up long ago.