HI Rob,
I saw your post about FreeIPA and XRDP. I cant login via xrdp with my IPA user account. A local account works fine. My guess is that the PAM parts cant find the "remote ipa user" account.
Tried to add xrdp and xrdp-sesman to HBAC rules and services but that doesnt make a difference.
How does your pam.d/xrdp-sesman look?
What more exactly did you do to HBAC?

Thanks!

/Mattias

Virus-free. www.avast.com