I think the issue is outlined in the PAC error you got.

On 11 Feb 2019, at 16:51, D via FreeIPA-users <freeipa-users@lists.fedorahosted.org> wrote:

sss_send_pac failed, group membership for user with principal [<my username>@AD.DOMAIN.COM] might not be correct.

It seems to indicate that the PAC in the ticket doesn’t match with the User+Group membership combo that was expected.

John