This bug is created as a clone of upstream ticket:
https://pagure.io/SSSD/sssd/issue/3431
The IPA subdomains code only loaded the naming suffixes when the subdomains changed. As effect, just restarting sssd breaks logins with enterprise principals.
The workaround is to remove the cache.
Created attachment 1388387[details]
Console output and krb5_child log
Verified
sssd-1.16.0-15.el7.x86_64
Now, "enterprise principal [true]", with UPN being used.
Attaching krb5_child log and Console output
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHEA-2018:0929