Just an update on this.
After a lot of debugging, signal tapping and head scratching it has been discovered that
there is a password reset script run from an external system (bladelogic) which for some
unknown reason decides to run "authconfig --update" after doing whatever it
does. This stops the SSSD service and doesn't automatically restart it - is this
normal behaviour?
A big thank you to Justin and Jakub for your help