SSSD

SSSD authentication

SSSD is an NSS provider, not a file editor. It answers identity lookups in memory / via its cache, sitting behind /etc/nsswitch.conf:

passwd: files sss

When something calls getpwnam("aduser"), glibc walks that list: checks /etc/passwd (files) first, then asks sss (SSSD), which queries AD and caches the answer. The /etc/passwd file is never modified by this. That's exactly why:

getent passwd aduser  → returns data (via sss)
grep aduser /etc/passwd → empty

So an AD user is a "real" resolvable account (uid, gid, home, shell) with no local file entry. Tools that only understand local files — usermod, useradd, userdel — refuse to touch it. That was the entire root cause of your original error.