Also make sure your pam configs are sorted and using sssd
grep -R sss /etc/pam.d/
/etc/pam.d/common-password:password sufficient pam_sss.so use_authtok
/etc/pam.d/common-auth:auth [success=1 default=ignore] pam_sss.so use_first_pass
/etc/pam.d/common-account:account [default=bad success=ok user_unknown=ignore] pam_sss.so
/etc/pam.d/common-session:session optional pam_sss.so