In the end, I was able to work around this by adding the following line to /etc/sssd.conf:
ldap_host_fqdn = cn
I have some YubiKeys on order and intend to test and document using passkey support (and as one of the maintainers of sssd in Gentoo, add passkey support to it). However, there is no schema with the "passkey" attribute, nor is there another attribute I can map to (like I can with ssh).
Is there a schema available for the "missing" attributes? If not, could one be created?