This is a bug in new feature implemented in https://bugzilla.redhat.com/show_bug.cgi?id=1507035

It does not show itself during manual testing, only during automation when there are two consecutive ssh login attempts.

First ssh login says the password is expired, the password is correctly changed.

The seconds login attempt however does not refresh the user record because it happened sooner then pam_id_timeout (default 5 seconds) and therefore sssd thinks that the user's password is still expired.

The successful password change should also update shadowLastUpdate in cache.

The bug can be reproduced with the new test framework: https://github.com/pbrezina/sssd-tests-poc
The test is:

@pytest.mark.topology(KnownTopology.LDAP)
def test_shadow(client: Client, ldap: LDAP):
    ldap.aci.add('(targetattr="userpassword")(version 3.0; acl "pwp test"; allow (all) userdn="ldap:///self";)')
    ldap.user('shadowuser1').add(
        shadowMin=0, shadowMax=99999, shadowWarning=7, shadowLastChange=0,
        password='Secret123'
    )

    # Disabling pam_id_timeout makes the test pass
    # client.sssd.pam['pam_id_timeout'] = '0'
    client.sssd.domain['ldap_pwd_policy'] = 'shadow'
    client.sssd.domain['ldap_chpass_update_last_change'] = 'True'
    client.sssd.start()

    assert client.auth.ssh.password_expired('shadowuser1', 'Secret123', 'Redhat@321')
    assert client.auth.ssh.password('shadowuser1', 'Redhat@321')