Ok, now you can apply the workaround from the linked article: Comment out
account [default=bad success=ok user_unknown=ignore] pam_sss.so
in /etc/pam.d/system-auth.
At some point I would like to understand properly where this comes from, though. So if you are willing to do some digging, here are some links that might explain what is going on: