[Samba] domain member login

[Sonic]

Hello,

I set up a Debian Bookworm Domain Member to test integration with a
Samba AD. I can successfully shell into the Domain Member via SSH
using AD user credentials but cannot login to the system locally via
the GUI using AD user credentials only local user credentials.
I've run across some online info suggesting using SSSD, but somehow I
think pam/winbind should be able to handle this, especially as SSH
works just fine.
Any clues? What am I missing? Any good up to date docs on this?

Thanks,
Chris