pam_sss problem

Suddenly we can't log in to the domain.

Changed from this:
steve@hh16:~> cat /etc/pam.d/common-auth
auth    required        pam_env.so
auth    optional        pam_gnome_keyring.so
auth    sufficient      pam_unix.so     try_first_pass 
auth    required        pam_sss.so      use_first_pass

to this:

auth    required        pam_env.so
auth    optional        pam_gnome_keyring.so
auth    sufficient      pam_unix.so     try_first_pass 
auth    sufficient      pam_sss.so      use_first_pass

Now all OK. Total mystery. BUT you now can't log in as a local user. Take your pick.