Bump the priority to, say, 512 in /usr/share/pam-configs/sss. Then run 'pam-auth-update'. Does it fix things?
Bump the priority to, say, 512 in /usr/share/ pam-configs/ sss. Then run 'pam-auth-update'. Does it fix things?