Description of problem:

Smartcard authentication fails for IPA users if SSSD is offline and
'krb5_store_password_if_offline = True'


Steps to Reproduce:

1) Install as a new RHEL 7.4 Server install using Server with GUI
2) Installed ipa-client and join the workstation to the domain by executing
ipa-client-install
4) Remove pam_pkcs11
5) Install opensc
6) Enabled SSSD authentication and smartcard authentication using "authconfig
--enablesmartcard --smartcardmodule=sssd --enablesssd --enablesssdauth
--updateall
7) Verify that /etc/sssd/sssd.conf contains pam_cert_auth = true under [pam],
and cache_credentials = true under the domain section
7) Restart sssd
8) Restart pcscd
9) Attempt to login to the domain account with username/password from the
console which should be successful
10) Log out
11) Attempt to login to the domain account with username/smartcard and no
password from the console which should be successful
12) Log out
13) Disconnect the network cable or remove connectivity to IPA server
14) Attempt to login to the domain account with username/smartcard and no
password from the console. Will get prompted for a PIN, but then the login
fails.
15) Attempt to login to the domain account with username/password from the
console should get sucessful at this moment
16) Then reconnect the network cable
17) Now attempt to login to the domain account with username/smartcard and no
password from the console will be successful



Actual results:

Attempt in 14th step is getting failed.


Expected results:

Attempt in 14th step also should be successful