I figured it out -- for some reason /etc/pam.d/system-auth-ac didn't contain the pam_sss.so entries. I had been running authconfig --update, but that wasn't adding them to the file. So I ran authconfig --updateall, which did the trick. Not sure why SSH login was working with SSSD, but maybe that uses a different config file. Jacob