For some obscure reason my latest docker deploy had the passwd: and group: lines end on 'systemd' instead of 'compat', so the find/replace nsswitch.conf tasks failed to add 'ldap' at the end.
Also, sshd 'ChallengeResponseAuthentication yes' doesn't seem to be default anymore, or I missed it because of manual installation attempts before.
For some obscure reason my latest docker deploy had the passwd: and group: lines end on 'systemd' instead of 'compat', so the find/replace nsswitch.conf tasks failed to add 'ldap' at the end.
Also, sshd 'ChallengeResponseAuthentication yes' doesn't seem to be default anymore, or I missed it because of manual installation attempts before.