Comment 4 for bug 957486

Uh oh, here we go again.. I reproduced your issue on precise. The pam-configs priorities have cause me a lot of grey hair before, and now it looks like the priority should again be _lower_ than 256 (pam_unix). Now it all makes perfect sense, but for some reason I was under the impression that on the password stack pam_sss should be _on top_, but that fails for local users.

So looks like I need to drop the priority back to 128 again. Could you check if that fixes things for you? Test auth & password change for both local and remote users.