Sorry, I should have been more precise, the account is not local, authentication is done with PAM to an LDAP server. The bash-impaired account can authenticate in lightdm and get to its desktop, so authentication is valid. It is only sh that doesn't start for him.