Tracing which identity source answers for a user: getent, id, nsswitch.conf and sss_cache

Goal

Determine which name service is answering for a given username or group on a Linux host, and clear a stale SSSD cache entry, when local files and a directory service (LDAP/SSSD/AD) are both in play.

Prerequisites

Read access to /etc/nsswitch.conf; sss_cache present if the host uses SSSD (installed alongside sssd-common/sssd-tools, as used for realmd/SSSD AD joins).

Steps

1. Read the lookup order for accounts: the passwd:, group: and shadow: lines in /etc/nsswitch.conf list the sources to consult, in order. Debian/Ubuntu's libnss-sss places sss after files; RHEL-family authselect profiles have placed sss before or after files depending on the release, so read the actual line rather than assuming. The man page documents this per-database source-list format.
2. Resolve a specific name the same way any program on the system would: getent passwd alice walks the configured sources in order and prints the first match, or nothing if none matches — this is the authoritative way to check "does this system see this user", as opposed to grepping /etc/passwd directly, which only shows the local source.
3. Check what a fully resolved identity looks like, including group memberships that may come from a different source than the primary account: id alice, which the man page documents as printing user and group information for the specified user, including every group ID with -G, --groups — useful when a group membership added on the directory side does not show up.
4. If SSSD is one of the sources and a change made on the directory side (a new group membership, a disabled account) is not showing up, the cause is often SSSD's cache rather than a lookup-order problem: sss_cache -E (as root) expires all cached entries across every configured domain, forcing the next lookup to go back to the provider instead of returning a stale cached record. sss_cache -u <user> targets a single user instead of the whole cache.
5. Confirm the fix: rerun getent passwd alice (or id alice) and check the field or group membership that had been stale.

Expected result

getent passwd <name> and id <name> reflect the directory's current state within one lookup after sss_cache -E, without needing to restart the sssd service. Sessions that were already logged in keep their old group list until the user logs in again.

Limits and test basis

getent passwd without a name normally lists only local users, because SSSD does not enumerate directory users by default; always query a specific name. getent only reports what NSS resolves; if files precedes sss in nsswitch.conf and a stale or conflicting local entry exists for the same name, it wins and no directory data is ever consulted for that name. sss_cache -E expires cache entries so the next request is verified against the provider — it does not itself contact the provider, so a lookup must follow it to see the refreshed data, and a provider that is unreachable at that moment can still cause SSSD to serve the (now marked stale) cached value depending on its offline-cache configuration.