I have two FreeIPA servers running on Centos 7 - one a master the other a replica. I can create a new user account on the master using e.g. the GUI and it appears on both servers, is active and not locked. I can login using the FreeIPA gui on either server. I can login using ssh onto the master server and any domain clients, but when I (try to) ssh login on the replica I get the following in /var/log/secure:
date time server sshd[pid]: pam_sss(sshd:auth): authentication success; .... user=testuser
date time server sshd[pid]: pam_sss(sshd:account): Access denied for user testuser: 4 (System error)
date time server sshd[pid]: error: PAM: User account has expired for testuser from ip
The sssd configuration are logically equivalent, as in the entries refer to the master and replica. The krb5.conf files are logically equivalent in that the server entries refer to the master and replica. the password-auth files in /etc/pam.d are identical. Both new and existing accounts behave in the same way. sshd config files are identical.
I'm missing something .. any ideas ?