NOTE: This is a minor regression of pam_sss vs pam_ldap.

When attempting to "su -" to root pam_unix gives a nice log message which gets fed to our log based IDS:
Oct 7 09:57:20.000 sssdtest.la05.int su: pam_unix(su-l:auth): authentication failure; logname=jschroeder uid=7084 euid=0 tty=pts/94 ruser=jschroeder rhost= user=root

When su'ing to an account in ldap on an sssd client the message contains much less data:
Oct 7 09:57:49.000 sssdtest.la05.int su: pam_sss(su-l:auth): received for user someldapuser: 8 (Insufficient credentials to access authentication data)

I've tried reordering pam_unix before pam_sss in the session section of /etc/pam.d/system-auth with no luck. I've also tried changing pam_sss in session from sufficient to optional and a few variations thereof.

Can pam_sss be taught to print the source and destination user when there are authentication failures locally via sudo or su?