Realized I never set up any mapping rules, fixed that and they match properly.
Looking at the krb5_log now that's working, I see a few lines of interest:
[sss_krb5_prompter] (0x4000): sss_krb5_prompter name [(null)] banner [(null)] num_prompts
[1] EINVAL.
(2023-02-07 16:42:57): [krb5_child[699]] [sss_krb5_prompter] (0x4000): Prompt [0][Password
for user(a)INTERNAL.MY.DOMAIN].
(2023-02-07 16:42:57): [krb5_child[699]] [sss_krb5_prompter] (0x0200): Prompter interface
isn't used for password prompts by SSSD.
(2023-02-07 16:42:57): [krb5_child[699]] [sss_child_krb5_trace_cb] (0x4000): [699]
1675816977.033417: Preauth module encrypted_challenge (138) (real) returned:
-1765328254/Cannot read password
Here's that log:
https://pastebin.com/U7At3nkX