I think the issue is outlined in the PAC error you got.
On 11 Feb 2019, at 16:51, D via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
sss_send_pac failed, group membership for user with principal [<my
username>(a)AD.DOMAIN.COM] might not be correct.
It seems to indicate that the PAC in the ticket doesn’t match with the User+Group
membership combo that was expected.
John