Description of problem:
This issue is copied from 7.7 bug 1807065

In a scenario wherein following conditions are applied to krb5_server list ie,

first)  _srv_ entry is used in the list for krb5_server 
second) krb5kdc service is down in other SERVER's in the list 
third)  All servers in the list are resolvable

then it appears that _srv_ should be the first entry in the list otherwise failover doesn't work and user authentication fails. The following combinations fail to work:

krb5_server = Server-valid.example.com,Server2-valid.example.com,_srv_
krb5_server = Server-valid.example.com,_srv_
krb5_server = 10.16.200.11,_srv_

Lets assume that a server invalid.example.com is unresolvable, then following combination also fails:
krb5_server = _srv_,invalid.example.com
krb5_server = invalid.example,com,10.16.200.11,_srv_

However the below combinations work:

krb5_server = _srv_,Server-valid.example.com,Server2-valid.example.com
krb5_server = _srv_
krb5_server = _srv_,10.16.200.11
krb5_server = _srv_,10.16.200.11,Server-valid.example.com

Version-Release number of selected component (if applicable):
sssd-2.2.3-16.el8.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Setup a DNS server with valid KRB Server name and SRV records. 

A forward zone example would be:
-------------------------------
$TTL 604800
@       IN      SOA     Server1-valid.example.com. root.Server1-valid.example.com. (
                        2010050702 ; serial
                        604800 ; refresh
                        86400 ; retry
                        2419200 ; expire
                        10800 ; negative caching time
                        )
example.com.         IN NS  Server1-valid.example.com.
_ldap._tcp      IN SRV 1 0 389 Server1-valid
_kerberos._udp  IN SRV 0 0 88 Server1-valid
Server1-valid	IN A   10.19.34.83
Server2-valid   IN A   10.16.216.102
Server-valid    IN A   10.16.216.110
--------------------------------

2. Setup SSSD domain section with any one of the above failing krb5_server combination:

[domain/LDAP]
debug_level=0xFFF0
id_provider = ldap
ldap_uri = ldap://Server1-valid.example.com
ldap_search_base = dc=example,dc=com
auth_provider = krb5
krb5_realm = EXAMPLE.COM
krb5_server = Server-valid.example.com,_srv_
dns_discovery_domain = example.com

3. Ensure that Server-valid.example.com is resolvable and krb service is down, In this case, SSSD will be forced to use _srv_ to identify the working server.

4. Restart SSSD service and execute a user login. You will see that user auth fails. 

Actual results:
User auth fails whenever _srv_ is not the first entry in the krb_server list.

Expected results:
Failover should work and _srv_ should be processed irrespective of its position in the krb5_server list.

Additional info: