Why this is an SSSD bug?
Does it behave correctly if pam_unix is used instead of pam_sss?

We discussed the issue on IRC with Najmuddin. The problem is that the session stack of pam_sss doesn't check if the user it is processing is handled by the SSSD. We should check the existence of the user and return PAM_USER_UNKNOWN so that the pam stack carries on.

The simple workaround is to use pam_localuser.so

Upstream ticket:
https://fedorahosted.org/sssd/ticket/1670

*** Bug 886015 has been marked as a duplicate of this bug. ***

(In reply to comment #4)
> *** Bug 886015 has been marked as a duplicate of this bug. ***

Can you send me a link how pam_localuser.so should be defined?

I've checked the configuration and it looks that pam_localuser.so is defined:

---------------------

auth        required      pam_tally.so deny=5 onerr=fail file=/var/log/faillog no_magic_root
auth        required      pam_env.so
auth        sufficient    pam_unix.so try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet user ingroup La_KR_SRV_0007_AA
auth        sufficient    pam_sss.so use_first_pass
auth        required      pam_deny.so
#
account     required      pam_tally.so  deny=5 file=/var/log/faillog reset no_magic_root
account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account     required      pam_permit.so
#
password    required      pam_cracklib.so retry=3 minlen=8 dcredit=0 ucredit=0 lcredit=0 ocredit=0 type=
password    sufficient    pam_unix.so remember=7 use_authtok md5 shadow
password    sufficient    pam_sss.so use_authtok
password    required      pam_deny.so
#
session     required      pam_mkhomedir.so umask=0022 skel=/etc/skel/
session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     sufficient    pam_sss.so
session     required      pam_unix.so

and last but not least - when is it going to be fixed?

(In reply to comment #6)
> I've checked the configuration and it looks that pam_localuser.so is defined:

You should add a 'pam_localuser.so' entry under "session" section, prior to pam_sss.

for eg: 


session     required      pam_mkhomedir.so umask=0022 skel=/etc/skel/
session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     sufficient    pam_localuser.so  ## <-Add
session     sufficient    pam_sss.so
session     required      pam_unix.so

(In reply to comment #7)
> and last but not least - when is it going to be fixed?

Currently scheduled for upstream 1.10 release. Please work with your support representative if you need this bug to be fixed sooner.

See https://bugzilla.redhat.com/show_bug.cgi?id=905340#c3

This problem was fixed in the 6.4 rebase to 1.9 as a side effect of improving PAM return codes.