I was deploying a new CentOS 7 guest and noticed that the sssd.conf had sudo added twice to the services line.
The comment on line 93 says that 4.1.0 takes care of this now, but line 96 still includes freeIPA version 4 and less

if [ $freeipa_client_version_major -le 4 ]

Probably should be:

if [ $freeipa_client_version_major -lt 4 ]

Thanks.