Brand new Debian box (tried Buster, then when that didn;' work, upgraded tp unstable - meh, it's a test box to get things sorted out before production use).
....
su'd to root
apt install'd aptitude, realmd, packagekit
(packagekit grabbed the needed dependencies, such as sssd and samba (at least parts of them, and maybe part of KRB5 (the keytab thing-y), and [mostly] configured them)
Ran "realm join MY.DOMAIN -U my_add-to-domain_user"
getent passwd domain_user successfully returns data on the domain user:
acutech@21260-debianvm:~$ getent passwd glerp@my.domain
glerp@my.domain:*:495633057:495600513:glerp:/home/glerp@my.domain:/bin/bash
....
....
Here are a few relevant lines from /var/log/auth.log:
Feb 21 17:04:54 21260-debianvm sshd[5284]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1 user=glerp@my.domain
Feb 21 17:04:54 21260-debianvm sshd[5284]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1 user=glerp@my.domain
Feb 21 17:04:54 21260-debianvm sshd[5284]: pam_sss(sshd:account): Access denied for user glerp@my.domain: 6 (Permission denied)
Feb 21 17:04:54 21260-debianvm sshd[5284]: Failed password for glerp@my.domain from 127.0.0.1 port 59998 ssh2
Feb 21 17:04:54 21260-debianvm sshd[5284]: fatal: Access denied for user glerp@my.domain by PAM account configuration [preauth]