In debian/rules, there is an explicit check for if the package is building
on Ubuntu, and if so, -DWITH_PKCS11=OFF is passed to the build system:
https://salsa.debian.org/debian-remote-team/freerdp3/-/blob/master/debian/rules?ref_type=heads#L116

The comment above that says this is because Ubuntu doesn't have
pkcs11-helper in main, however, the dependency on libpkcs11-helper1-dev
was removed in b3bb8a993a75f6c17670e27646c934ddfc5f1f99:
https://salsa.debian.org/debian-remote-team/freerdp3/-/commit/b3bb8a993a75f6c17670e27646c934ddfc5f1f99

(and libpkcs11-helper1-dev is also in main).

Building without PKCS11 support breaks smartcard-logon with NLA.

Testing against a Windows Server 2022 VM leads to

  $ wlfreerdp /v:WIN-1F5GLL3AM1S.lab.local /u:Administrator /d:lab.local /smartcard-logon

  [14:23:18:881] [24609:00006021] [ERROR][com.freerdp.smartcardlogon] - [smartcard_getCert]: no suitable smartcard certificates were found
  [14:23:18:881] [24609:00006021] [ERROR][com.freerdp.core.nla] - [nla_adjust_settings_from_smartcard]: unable to get smartcard certificate for logon
  [14:23:18:881] [24609:00006021] [ERROR][com.freerdp.core.transport] - [transport_connect_nla]: NLA begin failed

while if I explicitly pass the kerberos config flag

  $ wlfreerdp /v:WIN-1F5GLL3AM1S.lab.local /u:Administrator /d:lab.local /smartcard-logon /kerberos:pkcs11-module:/usr/lib/x86_64-linux-gnu/opensc-pkcs11.so

  [14:23:25:553] [24614:00006026] [WARN][com.winpr.ncrypt] - [winpr_NCryptOpenStorageProviderEx]: rebuild with -DWITH_PKCS11=ON to enable smartcard logon support
  [14:23:25:553] [24614:00006026] [ERROR][com.freerdp.smartcardlogon] - [smartcard_hw_enumerateCerts]: unable to open provider given by pkcs11 module
  [14:23:25:553] [24614:00006026] [ERROR][com.freerdp.core.nla] - [nla_adjust_settings_from_smartcard]: unable to get smartcard certificate for logon
  [14:23:25:553] [24614:00006026] [ERROR][com.freerdp.core.transport] - [transport_connect_nla]: NLA begin failed

Simply removing the -DWITH_PKCS11=OFF from debian/rules and rebuilding
the package allows successful smartcard logon.

Would it be possible to drop the -DWITH_PKCS11=OFF flag from debian/rules?

Yes

This makes sense to me with the analysis you provided.

Thank you,
Jeremy Bícha

Hello,

Bug #1140689 in freerdp3 reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/debian-remote-team/freerdp3/-/commit/2acef1dd759b302d4f2518b82f33ebdccbe3fbd6
------------------------------------------------------------------------
stop disabling PKCS11 on ubuntu (Closes: #1140689)
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1140689

We believe that the bug you reported is fixed in the latest version of
freerdp3, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1140689@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Michael Tokarev <mjt@tls.msk.ru> (supplier of updated freerdp3 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 30 Jun 2026 09:34:23 +0300
Source: freerdp3
Architecture: source
Version: 3.27.1+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Remote Maintainers <debian-remote@lists.debian.org>
Changed-By: Michael Tokarev <mjt@tls.msk.ru>
Closes: 1138658 1140689
Changes:
 freerdp3 (3.27.1+dfsg-1) unstable; urgency=medium
 .
   [ Jeremy Bícha ]
   * Don't build sso-mib feature on i386
 .
   [ Grayson Wolf ]
   * fix test failures by enforcing TLS security
 .
   [ Michael Tokarev ]
   * Revert "Don't build sso-mib feature on i386"
   * stop disabling PKCS11 on ubuntu (Closes: #1140689)
   * new upstream bugfix release 3.27.1
     Hopefully closes: #1138658 (xrdp debci failure)
Checksums-Sha1:
 5812bdd93c7dbc2c0cb9e6195fa7ccb85db35022 4559 freerdp3_3.27.1+dfsg-1.dsc
 4962c7a87db1b604ee247a667c1a840ad26454ab 5196608 freerdp3_3.27.1+dfsg.orig.tar.xz
 c81bbf63015131647c948d2f7a36c15c0fc1a6ba 55476 freerdp3_3.27.1+dfsg-1.debian.tar.xz
 c1e6ea64bc8593257bb5cc9722a6efcdd5fa9765 6089 freerdp3_3.27.1+dfsg-1_source.buildinfo
Checksums-Sha256:
 832188c5f6781ef3a76f2acaa58e0da099ade30a045bffd89b17928d14f57369 4559 freerdp3_3.27.1+dfsg-1.dsc
 7283c75b0b2c254ad3895cc8c419c10273dfb6a71dbb15cdd971747468018ae8 5196608 freerdp3_3.27.1+dfsg.orig.tar.xz
 8b743b57f77672d136df6b043f8ddcae9589bce81e12ded070c2697e9afb3698 55476 freerdp3_3.27.1+dfsg-1.debian.tar.xz
 1b3142ddde38cd162fed9adbbd921e7aef7d2ece1ad87418bab0d926c10d7e44 6089 freerdp3_3.27.1+dfsg-1_source.buildinfo
Files:
 2be3ccaff7fc412be0fb82e2f68931a5 4559 x11 optional freerdp3_3.27.1+dfsg-1.dsc
 73647621df4f691c5d776ea5689e426d 5196608 x11 optional freerdp3_3.27.1+dfsg.orig.tar.xz
 70aa1ca284f6bf4ab27aba023b8b15ff 55476 x11 optional freerdp3_3.27.1+dfsg-1.debian.tar.xz
 85ae95c99d98a2d16c66636d4afdf309 6089 x11 optional freerdp3_3.27.1+dfsg-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

wsG7BAEBCgBvBYJqQ2OHCRCCqkokOx6UeEcUAAAAAAAeACBzYWx0QG5vdGF0aW9u
cy5zZXF1b2lhLXBncC5vcmcu5vdANLRi4a6vo0BIbSbuJ1pX20YEAgg6UT8QDOfZ
HBYhBGSqKrUx1WkDNmv++YKqSiQ7HpR4AAD56BAAqy8q5o0oD4mp3hvlAEXVZHWu
0jBSEzURIX2j1im4EdZy2lnpXhDfR70bHXKNeaY73vcyXhxc9m8O95rZVl4HjHaA
rm2o7aX49qQnfZZIffSOrKzuxst4bwUIoe3n7Klj+4oJEhbkC12Df3Hn/YS9Tc0s
ws/pqmu40Rx6CpScNUHog3YhlGyUODdIqj5nNPNZDac1zZpV+7G4GuIVMevHqGM9
K6DZn5Nzo7itHQDwVZhb1aWADN0D7uhibYnvhOpgVonwHCLXqf/JrGiX21ywm//o
2ieB55xGAhkx/V0vRqGKNjWF68zv1ce9tWxQQ7IyeB1/beMjNTotSPqNaW+iJr3U
AZvk8/V2rMbp0VWS49i73WnEaBHI2KgzFB3xSFGoEAo7g+ynR/wOknVkBsWCT2Uy
b+jgXxZRzqVHJcBjC9kF2SCGneqkYkZqHD5vPF8paa1ryW41xEClPLsRBeSF1+si
hnT7R0kt0/Pj0EW0y6l8bNo6x/BkW99Y73xY2xwjhjJ9kHqdunpekghrd+Is8HNH
XRGrFijRsU1MGICVxj+hOjn6etFQYNrzbhl7WCn+UZxftPCv8anwmUn//TyOqKE7
MsxYAt5Hf8az4vvlUVoBqTgCoCF5ilt7am/871STYTyvsiOIIMFoFcsyMV0RAmWd
UtaTtHzJ5wMde4SsYrY=
=HTUH
-----END PGP SIGNATURE-----