[ubuntu] Permission denied at lock screen for AD users

I've already asked this question over at askubuntu here: (http://askubuntu.com/questions/76707.../767515#767515) So I apologize if it is against etiquette to re-post it here.

On xenial, the lock screen doesn't work for me. Whether I enter the correct password or not, it won't let me in. However, if I click on the menu at the top right coer of the screen and choose "switch user," but choose the same user as at the lock screen it lets me right in.

At the lock screen, authentication seems to work correctly. It just doesn't authorize me. Here's what I see in /var/log/auth.log:

May  3 11:57:44 hostname compiz: pam_krb5(unity:auth): user myuser authenticated as [email protected]
May  3 11:57:44 hostname compiz: gkr-pam: unlocked login keyring
May  3 11:57:44 hostname compiz: pam_sss(unity:account): Access denied for user myuser: 6 (Permission denied)

Only AD accounts are affected by this. Local accounts are not.

It also fails when ruing something via the gui that requires elevated privileges. For example, when installing software from the Ubuntu Software Center. It won't let an AD account authorize installation, but it will allow a local user to authorize it. Yet from the command line, AD accounts can use sudo with no issues.

Something is making pam unhappy. Any idea what it could be?

On a test box, I tried switching to gdm3 instead of lightdm, but that won't even get me to a login screen. I just get a blank screen. I think there is a known bug with gdm and Nvidia drivers.

I've got a couple of other users in my office that want to upgrade to xenial, but I've told them to hold off until I get this figured out.