I'm running a Fedora 44 desktop that was upgraded (in-place) from Fedora 43. The desktop is enrolled into an AlmaLinux 9 IdM domain that is in a trust with AD. Trusted users can login when sssd is connected to IdM. When the connection to IdM is unavailable (e.g. the VPN drops), new logins with trusted user account are denied and existing trusted user logins can't use sudo (denied).

Offline logins or sudo use with trusted users has worked flawlessly for many releases. It also worked after the upgrade to Fedora 44. The current issue began less than a month ago.

I have no changes on the IdM domain side (or in AD, that I know of).

Offline login attemps fail immediately (there is zero delay). If I try offline sudo usage, it fails immediately after I enter the password, but the password prompt takes a few seconds to appear.

User lookup while offline does work (i.e. id trustedUser or sssctl user-checks trustedUser.tld).

Reproducible: Always

Steps to Reproduce:
1. Connect to VPN 
2. Login with trusted user into GNOME or via ssh
3. Use sudo with any command
4. Disconnect the VPN
5. Try new login to GNOME or via ssh
6. Try sudo with any command
Actual Results:
Immediate login fail or sudo use denied.

Expected Results:
Offline login or sudo use allowed, with some initial delay because sssd has to determine the backend is offline and switches to using the cached credentials.

Additional Information:
ranbir@pc:~$ ssh trustedUseru.domain.tld
(trustedUser.domain.tld) Password: 
Connection closed by 1.2.3.4 port 22

Interesting log from the journal for sshd:
sshd-session[99030]: error: PAM: User account has expired for [[removed username]]