An SSSD cache stays warm while the identity provider rotates usernames with a new realm suffix during a failover rehearsal

Authentication works in one place and the cached identity model remains anchored to the old directory naming contract. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.