With default priority (128), pam-auth-update put module pam_sss after
module pam_unix in /etc/pam.d/common-auth, and then a user with a
local account and local password synchronized with AD password will
never be granted a Kerberos TGT on session opening.
According to pam-auth-update(8), it is an error to use option --force
in postinst script:
This option must not be used by package maintainer scripts;
it is intended for use by administrators only.
