Hi,
Please see the commit message and the ticket description. Also please
note that if you're testing with a non-privileged user, you also need to
set:
allow sssd_selinux_manager_t self:capability setgid;
allow sssd_selinux_manager_t self:capability setuid;
Otherwise there will be AVC denials.