You're right, and that was using LDAP.

When trying to get sss_ssh_authorizedkeys working on my FreeIPA host itself just now (which of course uses id_provider = ipa), I actually encountered this problem again, too. There it was related to the fact that sss_ssh_authorizedkeys queries the implicit_files domain first. When explicitly specifying the correct domain, it works. Not sure how to properly fix this though.

On Tue, 23 Oct 2018 at 15:28, Alexander Bokovoy <abokovoy@redhat.com> wrote:
On ti, 23 loka 2018, Johannes Falke via FreeIPA-users wrote:
>For posterity, I had the same issue and fixed it by explicitly setting
>
>    ldap_user_ssh_public_key = ipaSshPubKey
>
>in the domain portion of sssd.conf. Otherwise I assume it looks for the
>attribute "sshPublicKey", since that's what it's called in the sssd cache
>DB.
ipasshpubkey is the default for 'id_provider = ipa', so you don't need
to change that if you are actually using IPA id provider.


--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland