First let me say this is something we need to do in the short term to work around an issue/bug with SSSD cache. I have done a rudimentary test shutting down SSSD and configuring /etc/nsswitch.conf, /etc/ldap.conf and /etc/nscd.conf back to the way we use them on SLES 11 (we have both SLES 11 and SLES 12 running on different servers) and LDAP appears to work just fine.

My question is: has SLES 12 been tightly coupled to SSSD such that not running SSSD will cause us any problems in other areas?

Background: We have an LDAP directory used throughout the company and the presence of legacy systems that cannot handle groups with a very large membership lists has been circumvented by splitting large groups into many sub-groups with the same GID but a series of suffices in the name. This has worked fine for many years, despite being something of a hack. The remaining older systems are being patched to handle large groups at which point we can flatten the sub-groups to single groups. However this is a long and drawn-out process. With the introduction of SLES 12 we discovered that SSSD does not handle multiple groups in a predictable fashion. Sometimes it works fine, but it can get into a state where the cache has more than one entry with the same GID and then SSSD returns an empty results and an error for any lookup involving that GID. The cache does not appear to expire the entry so drastic action is needed to "reset" the cache.

So we need to revert to non-SSSD configuration until we can complete the group re-alignment or until we can get a "fix" for SSSD - I'm sure there would be debate about whether this is a bug or not, but it is a change in behavior, and the results are not consistent.

So if anyone can answer the question above, I'd be most grateful. I'm sure we could debate the validity of our use of sub-groups etc. for a long time, and I'd be happy to do that, but I'd really like some feedback on the central question first :-)