Welcome to the forums.
Remember... there's no "Centrify" server. It's all AD and our clients.
Since you are using Express, keep in mind that ALL users from AD are exposed to your UNIX/Linux systems.
If there's an "oracle" account in AD, due to the NSS order, that's the account that will authenticate first.
You can find out if there's an oracle account in AD by running the "adquery user oracle"
If you get a response back (a UNIX-style identity line), then the user that is being authenticated is AD's oracle, not /etc/passwd's oracle.
To go around this, you must set oracle as an entry in the /etc/centrifydc/users.ignore file and do a sudo adreload or restart the centrifydc service.
If you are not using Express, note that you have benefits like SLA-based support.
R.P