Hi Rob,
This is on a newly re-enrolled client (it runs
force-join, previously it joined with different arguments but the machine does not have any data that itself persists between boots). I don't see the issue on a previously enrolled client. I have verified this is causing the failure with group related auth because if I edit the group names in /etc/ssh/sshd_config to include @
domain.com, I am able to log on as my user via key. I am also concerned that this can affect other processes and systems, as I'm not sure what has caused it and it persists after each ipa setup (reboot of the machine). I did notice the following enabled in IPA server->configuration:
MS-PAC
But I'm not sure if this has anything to do with the behavior.
Roger