we have an OpenSSH server in a Windows Server 2019, this is the OpenSSH version:

PS C:UsersJohn> ssh -V
OpenSSH_for_Windows_7.7p1, LibreSSL 2.6.5

And this is the output of the accepted keys:

PS C:UsersJohn> ssh -Q key
ssh-ed25519
[email protected]
ssh-rsa
ssh-dss
ecdsa-sha2-nistp256
ecdsa-sha2-nistp384
ecdsa-sha2-nistp521
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

Our sshd_config file has the following lines:

PubkeyAuthentication yes
PubkeyAcceptedKeyTypes +ssh-dss

The ssh-dss key is in the users authorized_keys file but inspite that, the user is not able to authenticate.
We understand that the ssh-dss algorithm is deprecated and not recommended but the platform that is integrating with our server is not able to use other algorithm, it must be ssh-dss.

This is what the log says:

9660 2024-05-31 11:49:43.365 debug1: userauth-request for user john@ourdomain service ssh-connection method none [preauth]
9660 2024-05-31 11:49:43.365 debug1: attempt 0 failures 0 [preauth]
9660 2024-05-31 11:49:43.365 debug3: mm_getpwnamallow entering [preauth]
9660 2024-05-31 11:49:43.365 debug3: mm_request_send entering: type 8 [preauth]
9660 2024-05-31 11:49:43.365 debug3: mm_getpwnamallow: waiting for MONITOR_ANS_PWNAM [preauth]
9660 2024-05-31 11:49:43.365 debug3: mm_request_receive_expect entering: type 9 [preauth]
9660 2024-05-31 11:49:43.365 debug3: mm_request_receive entering [preauth]
9660 2024-05-31 11:49:43.365 debug3: mm_request_receive entering
9660 2024-05-31 11:49:43.365 debug3: monitor_read: checking request 8
9660 2024-05-31 11:49:43.365 debug3: mm_answer_pwnamallow
9660 2024-05-31 11:49:43.365 debug2: parse_server_config: config reprocess config len 422
9660 2024-05-31 11:49:43.365 debug3: checking match for 'Group administrators' user ourdomain\john host 10.102.2.79 addr 10.102.2.79 laddr 10.202.33.61 lport 22
9660 2024-05-31 11:49:43.381 debug3: lookup_principal_name: Successfully discovered explicit principal name: 'ourdomain\john'=>'[email protected]'
9660 2024-05-31 11:49:43.397 debug3: LsaLogonUser Succeeded (Impersonation: 0)
9660 2024-05-31 11:49:43.397 debug1: user 260G365324@02 does not match group list administrators at line 86
9660 2024-05-31 11:49:43.397 debug3: match not found
9660 2024-05-31 11:49:43.397 debug3: mm_answer_pwnamallow: sending MONITOR_ANS_PWNAM: 1
9660 2024-05-31 11:49:43.397 debug3: mm_request_send entering: type 9
9660 2024-05-31 11:49:43.397 debug2: monitor_read: 8 used once, disabling now
9660 2024-05-31 11:49:43.397 debug2: input_userauth_request: setting up authctxt for john@ourdomain [preauth]
9660 2024-05-31 11:49:43.397 debug3: mm_inform_authserv entering [preauth]
9660 2024-05-31 11:49:43.397 debug3: mm_request_send entering: type 4 [preauth]
9660 2024-05-31 11:49:43.397 debug2: input_userauth_request: try method none [preauth]
9660 2024-05-31 11:49:43.397 debug3: userauth_finish: failure partial=0 next methods="publickey,password,keyboard-interactive" [preauth]
9660 2024-05-31 11:49:43.397 debug3: send packet: type 51 [preauth]
9660 2024-05-31 11:49:43.397 debug3: mm_request_receive entering
9660 2024-05-31 11:49:43.397 debug3: monitor_read: checking request 4
9660 2024-05-31 11:49:43.397 debug3: mm_answer_authserv: service=ssh-connection, style=
9660 2024-05-31 11:49:43.397 debug2: monitor_read: 4 used once, disabling now
9660 2024-05-31 11:49:43.412 debug3: receive packet: type 50 [preauth]
9660 2024-05-31 11:49:43.412 debug1: userauth-request for user john@ourdomain service ssh-connection method publickey [preauth]
9660 2024-05-31 11:49:43.412 debug1: attempt 1 failures 0 [preauth]
9660 2024-05-31 11:49:43.412 debug2: input_userauth_request: try method publickey [preauth]
9660 2024-05-31 11:49:43.412 userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes [preauth]
9660 2024-05-31 11:49:43.412 debug2: userauth_pubkey: authenticated 0 pkalg ssh-dss [preauth]
9660 2024-05-31 11:49:43.412 debug3: userauth_finish: failure partial=0 next methods="publickey,password,keyboard-interactive" [preauth]
9660 2024-05-31 11:49:43.412 debug3: send packet: type 51 [preauth]
9660 2024-05-31 11:49:43.443 debug3: receive packet: type 50 [preauth]
9660 2024-05-31 11:49:43.443 debug1: userauth-request for user john@ourdomain service ssh-connection method keyboard-interactive [preauth]
9660 2024-05-31 11:49:43.443 debug1: attempt 2 failures 1 [preauth]
9660 2024-05-31 11:49:43.443 debug2: input_userauth_request: try method keyboard-interactive [preauth]
9660 2024-05-31 11:49:43.443 debug1: keyboard-interactive devs  [preauth]
9660 2024-05-31 11:49:43.443 debug1: auth2_challenge: user=john@ourdomain devs= [preauth]
9660 2024-05-31 11:49:43.443 debug1: kbdint_alloc: devices '' [preauth]
9660 2024-05-31 11:49:43.443 debug2: auth2_challenge_start: devices  [preauth]
9660 2024-05-31 11:49:43.443 debug3: userauth_finish: failure partial=0 next methods="publickey,password,keyboard-interactive" [preauth]
9660 2024-05-31 11:49:43.443 debug3: send packet: type 51 [preauth]
9660 2024-05-31 11:49:44.897 Connection closed by authenticating user john@ourdomain 10.102.2.79 port 14624 [preauth]

We have also tried with another user that was in the administrators group, and that user was able to authenticate with its ssh-dss key.

What are we doing wrong?