When seeing this:

krb5_child.log:(Tue May 22 02:06:15 2018) [[sssd[krb5_child[1605]]]] [map_krb5_error] (0x0020): 1657: [-1765328228][Cannot contact any KDC for realm ‘MDS.XYZ’]

Access denied
Using keyboard-interactive authentication.
Password:

reverse the order of your DNS hosts in /etc/resolv.conf to this:

[root@cm-r01dn07 sssd]# cat /etc/resolv.conf
search mds.xyz nix.mds.xyz
nameserver 192.168.0.224
nameserver 192.168.0.44
nameserver 192.168.0.45
[root@cm-r01dn07 sssd]#

from this:

[root@cm-r01dn07 sssd]# cat /etc/resolv.conf
search mds.xyz nix.mds.xyz
nameserver 192.168.0.44
nameserver 192.168.0.45
nameserver 192.168.0.224
[root@cm-r01dn07 sssd]#

And that solved it.

Cheers,
TK