I figured it out -- for some reason /etc/pam.d/system-auth-ac didn't contain the
pam_sss.so entries. I had been running authconfig --update, but that wasn't adding
them to the file. So I ran authconfig --updateall, which did the trick.
Not sure why SSH login was working with SSSD, but maybe that uses a different config
file.
Jacob