Hopefully there is something simple I am missing here.
I have FreeIPA 4.6.6 (can not update at this time), Centos 7 and Centos 6 systems.
SELinux is in permissive mode. Logins on the Centos 6 system are as expected, using the context configured/provided by FreeIPA. Logins on the Centos 7 system are always unconfined. ( this is not the the default provided by FreeIPA.
I have debugging on for the pam modules, and I am seeing logs, just no errors. The logs between CentOS 6 and 7 are the same, but the context supplied for CentOS 7 is incorrect. I have been unable to locate a reason for this.
It seems like the user context is not being processed and/or received correctly by CenOS 7. We authenticate through FreeIPA only and do not have any local users configured.
There are no errors in secure or audit.log. Authentication shows as successful, but contex I can not find anyone else having this type of issue.