When logging into my machine via ssh then pam_group.so module works as expected and assigns additional local groups to the logged in user as configured in /etc/security/group.conf. When logging in via ThinLinc the pam_group.so module seems to be ignored. The users don't get their configured local groups (e.g. sudo).
Thank you for the report. pam_group seems to do its work in the hidden "setcred" stage of PAM, which unfortunately isn't currently performed by ThinLinc. Looking at sshd, it performs this stage unconditionally, just before the "session" stage. We should probably do the same. Also, worth to note is that sshd ignores any errors from the "setcred" stage if the "auth" stage isn't performed, which is likely also relevant for us.
I did a check of the other PAM modules included in Linux PAM, and could not find any other module that relies solely on "setcred" like pam_group does. So the issue should hopefully not be widespread.
