Apparmor blocks GDM login for new users

That's most likely a permission problem. What does ls -l /home/username/.ICEauthority say? How did you create the user? Could you try creating another test user too?

as already mentioned:
ls -la /home/username/ at a shell logged in with the new username shows no such file (.ICEauthority).

I tried:
copying the file from another user (that actually works) and changing the owner, group and permissions corresponding to the new user. Even using the new file with iceauth show worked without problems.
but login with gdm was still not possible.

the new user was created by "users-admin" and i tried it a few times with different usernames.

Sorry, I meant the output of ls -la /home/, i.e. to see the permissions set on the home folder. If you do
sudo su gdm
touch/home/username/.ICEauthority
does it work?

ls -la /home/
shows that "drwxr-xr-x " and owner+group are the same as the user.
touch ... didn't help.

interesting thing:
once the new user was logged in with lightdm also the log in with gdm works perfectly. Even if /home/username/.ICEauthority doesn't exist.

to be a bit more specific:
/home/username/.ICEauthority can be deleted before the login. it seems to be created again on login.

Yeah, the point of the GDM error is that it should be able to create it on login if not present. Have a look at /var/log/gdm/* and at ~/.xesssion-errors and see whether there are more details.

You're right, there are some errors in those logs.

xsession-errors says: "Failed to create secure directory: Keine Berechtigung" (means no permission)

and there are also some permission problems in /var/log/gdm/:0-slave.log (however, this file should be for the user i am currently working with? I exprience no problems with that one... ) and :0-slave.log.1 (there is my test user mentioned, and that is the one that fails).

for example:
(gnome-settings-daemon:3358): color-plugin-WARNING **: failed to create profile from EDID data: Fehler beim Erstellen des Ordners: Keine Berechtigung (means no permission to create folder)

Anything in /var/log/messages about apparmor or gdm?

after uncommenting

*.=info;*.=notice;*.=warn;\
 auth,authpriv.none;\
 cron,daemon.none;\
 mail,news.none -/var/log/messages
in "/etc/rsyslog.d/50-default.conf"

there are some messages about apparmor in /var/log/messages.

The apparmor messages are generated when trying to access the /home/test directory with the guest user. This is expected and by design and should not affect the 'test' user from logging in at all. Also, the denials are from the gdm guest session profile as shipped by gdm, so I am closing the apparmor task.