https://bugzilla.redhat.com/show_bug.cgi?id=2333529
--- Comment #9 from Gregory Lee Bartholomew gregory.lee.bartholomew@gmail.com ---
What exactly is broken?
With "account required pam_sss.so" in /etc/pam.d/password-auth, I would get the following when trying to ssh into the container:
sshd[167993]: fatal: Access denied for user slartibartfast by PAM account configuration [preauth]
Changing that line in the PAM stack to "account required pam_sss.so ignore_authinfo_unavail" would resolve the error (or manually changing the UID and GID mappings around so that the sssd user would have the same IDs in the container as in the host).
IMHO, SSSD should get one of the reserved UIDs in the 0-200 range so it will be the same across different installations and bind mounts between them would have correct ownership. 42 would be a good UID/UID for SSSD. :-)