Dear Lukas,

In this case it's ssh. I just tried it using su - and it worked as expected. 

- Seth

>>> su - worked

>>>>>>>>>>>>>>>> pam section of auth people for ssh that did not prompt

[sssd[be[auth-people]]] [sbus_dispatch] (0x4000): dbus conn: 0x24302d0

[sssd[be[auth-people]]] [sbus_dispatch] (0x4000): Dispatching.

[sssd[be[auth-people]]] [sbus_message_handler] (0x4000): Received SBUS method [pamHandler]

[sssd[be[auth-people]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit

[sssd[be[auth-people]]] [sbus_handler_got_caller_id] (0x4000): Received SBUS method [pamHandler]

[sssd[be[auth-people]]] [be_req_set_domain] (0x0400): Changing request domain from [auth-people] to [auth-people]

[sssd[be[auth-people]]] [be_pam_handler] (0x0100): Got request with the following data

[sssd[be[auth-people]]] [pam_print_data] (0x0100): command: PAM_SETCRED

[sssd[be[auth-people]]] [pam_print_data] (0x0100): domain: auth-people

[sssd[be[auth-people]]] [pam_print_data] (0x0100): user: test-user

[sssd[be[auth-people]]] [pam_print_data] (0x0100): service: sshd

[sssd[be[auth-people]]] [pam_print_data] (0x0100): tty: ssh

[sssd[be[auth-people]]] [pam_print_data] (0x0100): ruser: 

[sssd[be[auth-people]]] [pam_print_data] (0x0100): rhost: ***.***.***.***

[sssd[be[auth-people]]] [pam_print_data] (0x0100): authtok type: 0

[sssd[be[auth-people]]] [pam_print_data] (0x0100): newauthtok type: 0

[sssd[be[auth-people]]] [pam_print_data] (0x0100): priv: 1

[sssd[be[auth-people]]] [pam_print_data] (0x0100): cli_pid: 27189

[sssd[be[auth-people]]] [pam_print_data] (0x0100): logon name: not set

[sssd[be[auth-people]]] [be_pam_handler] (0x0100): Sending result [0][auth-people]

[sssd[be[auth-people]]] [sbus_dispatch] (0x4000): dbus conn: 0x24302d0

[sssd[be[auth-people]]] [sbus_dispatch] (0x4000): Dispatching.

[sssd[be[auth-people]]] [sbus_message_handler] (0x4000): Received SBUS method [pamHandler]

[sssd[be[auth-people]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit

[sssd[be[auth-people]]] [sbus_handler_got_caller_id] (0x4000): Received SBUS method [pamHandler]

[sssd[be[auth-people]]] [be_req_set_domain] (0x0400): Changing request domain from [auth-people] to [auth-people]

[sssd[be[auth-people]]] [be_pam_handler] (0x0100): Got request with the following data

[sssd[be[auth-people]]] [pam_print_data] (0x0100): command: PAM_OPEN_SESSION

[sssd[be[auth-people]]] [pam_print_data] (0x0100): domain: auth-people

[sssd[be[auth-people]]] [pam_print_data] (0x0100): user: test-user

[sssd[be[auth-people]]] [pam_print_data] (0x0100): service: sshd

[sssd[be[auth-people]]] [pam_print_data] (0x0100): tty: ssh

[sssd[be[auth-people]]] [pam_print_data] (0x0100): ruser: 

[sssd[be[auth-people]]] [pam_print_data] (0x0100): rhost: ***.***.***.***

[sssd[be[auth-people]]] [pam_print_data] (0x0100): authtok type: 0

[sssd[be[auth-people]]] [pam_print_data] (0x0100): newauthtok type: 0

[sssd[be[auth-people]]] [pam_print_data] (0x0100): priv: 1

[sssd[be[auth-people]]] [pam_print_data] (0x0100): cli_pid: 27189

[sssd[be[auth-people]]] [pam_print_data] (0x0100): logon name: not set

[sssd[be[auth-people]]] [be_pam_handler] (0x0100): Sending result [0][auth-people]

[sssd[be[auth-people]]] [sbus_dispatch] (0x4000): dbus conn: 0x24302d0

[sssd[be[auth-people]]] [sbus_dispatch] (0x4000): Dispatching.

[sssd[be[auth-people]]] [sbus_message_handler] (0x4000): Received SBUS method [pamHandler]

[sssd[be[auth-people]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit

[sssd[be[auth-people]]] [sbus_handler_got_caller_id] (0x4000): Received SBUS method [pamHandler]

[sssd[be[auth-people]]] [be_req_set_domain] (0x0400): Changing request domain from [auth-people] to [auth-people]

[sssd[be[auth-people]]] [be_pam_handler] (0x0100): Got request with the following data

[sssd[be[auth-people]]] [pam_print_data] (0x0100): command: PAM_SETCRED

[sssd[be[auth-people]]] [pam_print_data] (0x0100): domain: auth-people

[sssd[be[auth-people]]] [pam_print_data] (0x0100): user: test-user

[sssd[be[auth-people]]] [pam_print_data] (0x0100): service: sshd

[sssd[be[auth-people]]] [pam_print_data] (0x0100): tty: ssh

[sssd[be[auth-people]]] [pam_print_data] (0x0100): ruser: 

[sssd[be[auth-people]]] [pam_print_data] (0x0100): rhost: ***.***.***.***

[sssd[be[auth-people]]] [pam_print_data] (0x0100): authtok type: 0

[sssd[be[auth-people]]] [pam_print_data] (0x0100): newauthtok type: 0

[sssd[be[auth-people]]] [pam_print_data] (0x0100): priv: 0

[sssd[be[auth-people]]] [pam_print_data] (0x0100): cli_pid: 27192

[sssd[be[auth-people]]] [pam_print_data] (0x0100): logon name: not set

[sssd[be[auth-people]]] [be_pam_handler] (0x0100): Sending result [0][auth-people]

auth        required      pam_env.so

auth        sufficient    pam_unix.so nullok try_first_pass

auth        requisite     pam_succeed_if.so uid >= 500 quiet

auth        sufficient    pam_sss.so use_first_pass

auth        required      pam_deny.so

account     required      pam_access.so

account     sufficient    pam_unix.so broken_shadow

account     sufficient    pam_localuser.so

account     sufficient    pam_succeed_if.so uid < 500 quiet

account     [default=bad success=ok user_unknown=ignore] pam_sss.so

account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=

password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok

password    sufficient    pam_sss.so use_authtok

password    required      pam_deny.so

session     optional      pam_keyinit.so revoke

session     required      pam_limits.so

session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid

session     required      pam_unix.so

session     optional      pam_sss.so

auth       required     pam_sepermit.so

auth       include      password-auth

account    required     pam_nologin.so

account    include      password-auth

password   include      password-auth

# pam_selinux.so close should be the first session rule

session    required     pam_selinux.so close

session    required     pam_loginuid.so

# pam_selinux.so open should only be followed by sessions to be executed in the user context

session    required     pam_selinux.so open env_params

session    optional     pam_keyinit.so force revoke

session    include      password-auth

sshd[27189]: pam_sss(sshd:auth): received for user test-user: 12 (Authentication token is no longer valid; new one required)

sshd[27189]: Accepted password for test-user from ***.***.***.*** port 50120 ssh2

sshd[27189]: pam_unix(sshd:session): session opened for user test-user by (uid=0)