ccb17c7352
With default priority (128), pam-auth-update put module pam_sss after module pam_unix in /etc/pam.d/common-auth, and then a user with a local account and local password synchronized with AD password will never be granted a Kerberos TGT on session opening.