See /var/lib/dpkg/info/libpam-sss.postinst; when the libpam-sss package is installed,
"pam-auth-update" is run, which normally updates the various /etc/pam.d/common-*
files based on the contents of /usr/share/pam-configs.
If your PAM config files got screwed up for whatever reason, you should be able to run
"pam-auth-update" to fix things. If it detects that any of the common-* files
were modified outside of its control, it should print a warning advising you to re-run it
with --force to blow those changes away and get things working again.
--
Sam Morris <
https://robots.org.uk/>