Comment 3 for bug 1804417

As a workaround we now use the following configuration as the maintainer suggested to us:

# cat /etc/pam.d/runuser
#%PAM-1.0
auth sufficient pam_rootok.so
session required pam_localuser.so

Which works as well:
# runuser domainuser
runuser: cannot open session: Permission denied