SSSD offline authentication permits login with expired backend passwords
Background AlmaLinux 8 and 9 ship SSSD 2.8.x as the default service for centralized authentication against LDAP, Active Directory, or FreeIPA. SSSD caches password hashes locally to support offline login; the cache lifetime is governed by offline_credentials_expiration (default 0, meaning unlimited). When a user's password expires in the backend directory, S