FYI, the tmpfiles workaround from bug 1123699 solves the problem with sssd, in conjunction with the packages in comment 18. Both are needed, as tmpfiles + the (current) official sssd packages still fails.