Dear Lukas,
I found it! Thanks for your help you ended up setting me on the right path.
Turns out that this line in /etc/pam/password-auth-ac needed to be ----------------------------------------- account sufficient pam_unix.so broken_shadow ----------- Became ----------------- account required pam_unix.so broken_shadow -----------------------------------------
and that fixed it.
-Seth
sssd-users@lists.fedorahosted.org