Password Auth Works but Key Based Fails (One Way Trust Relationship)

"OpenSSH for Windows" version
OpenSSH_for_Windows_8.6p1, LibreSSL 3.3.3

Server OperatingSystem
Windows Server 2019

Client OperatingSystem
Windows Server 2019

What is failing

• Both server and client are in our AD environment (mycompany.com.azure) in Azure
• This Azure AD has one-way trust to our on-prem AD (Trusted domain)
• Using Windows IDs from the on-prem AD via password authentication is working but not key-based
• Key based auth only works if the Windows ID is in the Azure AD or local account in the server.

Expected output

• Key based authentication works since password authentication is working

Actual output
4252 2021-11-24 13:18:30.804 debug1: trying public key file C:\Users\d_nlds_sql\.ssh/authorized_keys
4252 2021-11-24 13:18:30.804 debug1: C:\Users\d_nlds_sql\.ssh/authorized_keys:1: matching key found: RSA SHA256:b1v/YYPlDjtPaETE0HlLDc4mDkXZMgv/jDe19wbSNMk
4252 2021-11-24 13:18:30.804 debug1: C:\Users\d_nlds_sql\.ssh/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
4252 2021-11-24 13:18:30.804 Accepted key RSA SHA256:b1v/YYPlDjtPaETE0HlLDc4mDkXZMgv/jDe19wbSNMk found at C:\Users\d_nlds_sql\.ssh/authorized_keys:1
4252 2021-11-24 13:18:30.804 debug3: mm_answer_keyallowed: publickey authentication: RSA key is allowed
4252 2021-11-24 13:18:30.804 debug3: mm_request_send: entering, type 23
4252 2021-11-24 13:18:30.804 debug3: mm_sshkey_verify: entering [preauth]
4252 2021-11-24 13:18:30.804 debug3: mm_request_send: entering, type 24 [preauth]
4252 2021-11-24 13:18:30.804 debug3: mm_sshkey_verify: waiting for MONITOR_ANS_KEYVERIFY [preauth]
4252 2021-11-24 13:18:30.804 debug3: mm_request_receive_expect: entering, type 25 [preauth]
4252 2021-11-24 13:18:30.804 debug3: mm_request_receive: entering [preauth]
4252 2021-11-24 13:18:30.804 debug3: mm_request_receive: entering
4252 2021-11-24 13:18:30.804 debug3: monitor_read: checking request 24
4252 2021-11-24 13:18:30.804 debug3: mm_answer_keyverify: publickey 0000029015C93110 signature verified
4252 2021-11-24 13:18:30.804 debug1: auth_activate_options: setting new authentication options
4252 2021-11-24 13:18:30.804 debug3: mm_request_send: entering, type 25
4252 2021-11-24 13:18:30.804 Accepted publickey for d_nlds_sql from 10.61.131.11 port 51067 ssh2: RSA SHA256:b1v/YYPlDjtPaETE0HlLDc4mDkXZMgv/jDe19wbSNMk
4252 2021-11-24 13:18:30.804 debug1: monitor_child_preauth: user d_nlds_sql authenticated by privileged process
4252 2021-11-24 13:18:30.804 debug3: mm_get_keystate: Waiting for new keys
4252 2021-11-24 13:18:30.804 debug3: mm_request_receive_expect: entering, type 26
4252 2021-11-24 13:18:30.804 debug3: mm_request_receive: entering
4252 2021-11-24 13:18:30.819 debug3: mm_get_keystate: GOT new keys
4252 2021-11-24 13:18:30.819 debug1: auth_activate_options: setting new authentication options [preauth]
4252 2021-11-24 13:18:30.819 debug2: userauth_pubkey: authenticated 1 pkalg rsa-sha2-512 [preauth]
4252 2021-11-24 13:18:30.819 debug3: user_specific_delay: user specific delay 0.000ms [preauth]
4252 2021-11-24 13:18:30.819 debug3: ensure_minimum_time_since: elapsed 0.000ms, delaying 8.696ms (requested 8.696ms) [preauth]
4252 2021-11-24 13:18:30.819 debug3: send packet: type 52 [preauth]
4252 2021-11-24 13:18:30.819 debug3: mm_request_send: entering, type 26 [preauth]
4252 2021-11-24 13:18:30.819 debug3: mm_send_keystate: Finished sending state [preauth]
4252 2021-11-24 13:18:30.819 debug1: monitor_read_log: child log fd closed
4252 2021-11-24 13:18:31.069 error: lookup_principal_name: User principal name lookup failed for user 'ho\d_nlds_sql' (explicit: 5, implicit: 5)
4252 2021-11-24 13:18:31.069 debug1: generate_s4u_user_token: LsaLogonUser() failed. User 'ho\d_nlds_sql' Status: 0xC0000062 SubStatus 0.
4252 2021-11-24 13:18:31.069 debug3: get_user_token - unable to generate token for user ho\d_nlds_sql
4252 2021-11-24 13:18:31.247 error: lookup_principal_name: User principal name lookup failed for user 'ho\d_nlds_sql' (explicit: 5, implicit: 5)
4252 2021-11-24 13:18:31.262 debug1: generate_s4u_user_token: LsaLogonUser() failed. User 'ho\d_nlds_sql' Status: 0xC0000062 SubStatus 0.
4252 2021-11-24 13:18:31.262 error: get_user_token - unable to generate token on 2nd attempt for user ho\d_nlds_sql
4252 2021-11-24 13:18:31.262 error: unable to get security token for user ho\d_nlds_sql
4252 2021-11-24 13:18:31.262 fatal: fork of unprivileged child failed

Start with the logged entry points lookup_principal_name, generate_s4u_user_token, and get_user_token, then reproduce key-based authentication for an on-premises AD user across the one-way trust. Compare the failing key-authentication path with the working password path; done means the user receives a security token and the SSH session completes.