Description of problem:
The sssd.conf(5) says:
       pwfield (string)
           The value that NSS operations that return users or groups will
return for the “password” field.
           This option can also be set per-domain.
           Default: “*” (remote domains) or “x” (the files domain)
However, for users returned via proxy files id_provider, * is returned. That in
turn breaks PAM authentication.
Version-Release number of selected component (if applicable):
sssd-2.2.3-20.el8.x86_64
How reproducible:
Deterministic.
Steps to Reproduce:
1. Have system without SSSD configured and started.
2. Set password for user test: passwd test
3. Test that PAM authentication or user test works:
   echo $THE_PASSWORD | pamtester sssd-shadowutils test authenticate
   If you don't like to use pamtester from EPEL, just use ssh test@localhost.
4. getent passwd test, check that the output is
   test:x:1000:1000::/home/test:/bin/bash
5. Configure SSSD, create /etc/sssd/sssd.conf with:
[sssd]
 domains = PROXY_PROXY
 services = nss
[domain/PROXY_PROXY]
 id_provider = proxy
 proxy_lib_name = files
 proxy_pam_target = sssd-shadowutils
6. chmod 600 /etc/sssd/sssd.conf or SSSD refuses to start.
7. systemctl restart sssd
8. getent passwd test
9. echo $THE_PASSWORD | pamtester sssd-shadowutils test authenticate
Actual results:
test:*:1000:1000::/home/test:/bin/bash
Password: pamtester: Authentication failure
Expected results:
test:x:1000:1000::/home/test:/bin/bash
Password: pamtester: successfully authenticated
Additional info:
It is possible to force the expected behaviour by adding line
 pwfield = x
to the [domain/...] section. But SSSD should obey what it says in the man page,
and it should not as easily break PAM authentication of unrelated services.