Session for winbind users is not always reconnect

[swer21]

When a winbind user has started a xrdp session using DOMAIN\username. Then he disconnect the session and later try’s to reconnect. But he uses only the username, the session is then not reconnected but a new session is created.

OS: Ubuntu 20.04.2 LTS
Version: 0.9.12

[matt335672]

hi @swer21

Thanks for raising this.

I think I can see what's happening here - at the moment we look for a matching session by checking the username string, which is normally unique. In the winbind case (and possibly with sssd), the same user can have different forms. hence the new sessions.

One way to work around this might be for the code to match on UID rather than username when looking for an existing session.

[swer21]

As a work around im currently blocking any logins with DOMAIN\USERNAME using this pam code.

auth [success=1 default=ignore] pam_succeed_if.so user !~ DOMAIN*
auth requisite pam_deny.so

Only downside is that some rdp client are sending the domain by default. At least mstsc on windows server 2012.

[evanlinde]

One way to work around this might be for the code to match on UID rather than username when looking for an existing session.

This would be very good. On my domain, there are at least 6 or 7 "valid" username forms that will be accepted by both winbind and sssd (tested via getent passwd _______):

• samid
• upn
• mail
• example\samid
• ad.example.edu\samid
• samid@example
• samid@ad.example.edu

samid -- SAMAccountName in active directory
upn -- userPrincipalName in active directory
mail -- email address

In my case, the upn is in the form of name@example.edu where the name part could be the same as samid, but mostly isn't. I'm not absolutely certain that mail gets used in an AD environment (mail and upn are always the same in ours) but it does get used in a non-AD LDAP with sssd.