Permit access to user from trusted domain

[x09]

Hi,

I have two AD domain (trust)

[root@alt ~]# sssctl domain-list
TEST.ALT
win.test

I have users in "rdp_users" group from trusted domain

[root@alt ~]# id  [email protected]
uid=679001103([email protected]) gid=679001103([email protected]) группы=679001103([email protected]),679001106([email protected]),679000513([email protected])

or

[root@alt ~]# id WIN.TEST\\winuser1
uid=679001103([email protected]) gid=679001103([email protected]) группы=679001103([email protected]),679001106([email protected]),679000513([email protected])

group memebers work fine also

[root@alt ~]# getent group [email protected]
[email protected]:*:679001106:[email protected],[email protected]

or

[root@alt ~]# getent group WIN.TEST\\rdp_users
[email protected]:*:679001106:[email protected],[email protected]

How i can specified TerminalServerUsers option in /etc/xrdp/sesman.ini for allow this group ([email protected])?

I tried
TerminalServerUsers=[email protected]
TerminalServerUsers=[email protected]
TerminalServerUsers=WIN.TEST\rdp_users
TerminalServerUsers=WIN.TEST\rdp_users
TerminalServerUsers=WIN.TEST\rdp_users
TerminalServerUsers=WIN.TEST\rdp_users

but always i get login denied for user WIN.TEST\winuser1 (or [email protected])

Jul 19 11:37:40 alt xrdp-sesman[4097]: pam_sss(xrdp-sesman:auth): authentication success; logname= uid=0 euid=0 tty=xrdp-sesman ruser= rhost= user=WIN.TEST\winuser1
Jul 19 11:37:40 alt audit[4097]: USER_AUTH pid=4097 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication grantors=pam_sss acct="WIN.TEST\winuser1" exe="/usr/sbin/xrdp-sesman" hostname=? addr=? terminal=xrdp-sesman res=success'
Jul 19 11:37:40 alt audit[4097]: USER_ACCT pid=4097 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting grantors=pam_sss acct="WIN.TEST\winuser1" exe="/usr/sbin/xrdp-sesman" hostname=? addr=? terminal=xrdp-sesman res=success'
Jul 19 11:37:40 alt xrdp-sesman[4097]: (4097)(140285919799104)[INFO ] login denied for user WIN.TEST\winuser1
Jul 19 11:37:40 alt xrdp[4102]: (4102)(140067377204544)[INFO ] xrdp_wm_log_msg: login failed for display 0

which format of trusted domain for TerminalServerUsers ?

[matt335672]

We added a patch to make this work better to v0.9.24 (release notes). Previous versions suffer from #2806.

Which version of xrdp are you running?

[x09]

We added a patch to make this work better to v0.9.24 (release notes). Previous versions suffer from #2806.

Which version of xrdp are you running?

Update to 0.10
set TerminalServerUsers=[email protected]
Work fine! Thnks!

[x09]

Additionally.
I can not add more than one group in TerminalServerUsers ?
Like as: TerminalServerUsers=rdp_users@domain1, rdp_users@domain2 ?

[matt335672]

No.

Use another group for that.