Present Behavior:
# vim  /usr/local/etc/sssd/sssd.conf
services = nss, pam
config_file_version = 2
domains = LDAP

ldap_search_base = dc=example,dc=com
id_provider = ldap
auth_provider = ldap9001   
<== 'sssctl config_check' does not reports this    1
ldap_uri = ldap://server.example.com
ldap_id_use_start_tls = True
ldap_tls_cacert = /etc/openldap/certs/cacert.asc
debug_level = tt       
<== 'sssctl config_check' does not reports this    2
klala =  1                <== 'sssctl config_check' reports this        3

My Interpretation:
sss_ini_call_validators_errobj()    //sssd/
    ini_rules_read_from_file(rules_path, &rules_cfgobj);        //rules_path=/usr/share/sssd/cfg_rules.ini        {All keywords on left side of assignment are rules which are read from cfg_rules.ini fills in struct ini_cfgobj}

Why sssd does reports 3?    Because rule is not present in cfg_rules.ini
Why sssd does not report 1,2?    May be
    - Because there is no such check in ding-lib about values of options.
    - OR Check is broken.    I also find
# cat /root/ding-libs-0.6.0/ini/ini.d/mysssd.conf
# Options available to all services
debug_level = int, None, false                                    <=Now what's this syntax. If it takes int, then is this broken.

Please throw some light...

Amit Kumar
There are three ways to get something done:
  (1) Do it yourself.
  (2) Hire someone to do it for you.
  (3) Forbid your kids to do it.