Dear Maintainer,

If a module is added to a new database, dh-nss generates a script that
does not check for the presency in all the listed databases and may just
accept if a service is in at least one database.

This is because the generated post-install script uses chained grep
patterns, and grep -e <pattern1> -e <pattern2> ... -e <patternN> will
make grep to exit without an error if at least one matches.

This implies that if a service file is:

  passwd: files systemd sss
  group: files systemd sss
  shadow: files sss

systemd won't ever be added to the shadow db.

Also, if the packager decides to move the position of the service, the
orded won't be adapted.

Ideally dh-nss should always:
 - Check the presency (and the right order) of the service per each database
   + If the service file is not defined for each database
    - Add the service in the right position in all the services
   + If the order does not match:
    - Remove the service
    - Add the service again in the right position

See also: https://bugs.launchpad.net/ubuntu/+source/dh-nss/+bug/2121017

Dear Marco,

this is the intended behaviour. dh-nss maintscripts are meant to do
install the default configuration if no previous sysadmin-provided
configuration is detected. Anything more complex requires a separate
program that will take over nsswitch.conf and regenerate it on every NSS
module update. (That was the plan for dh-nss v2, but that plan is
currently on hold, see below.)

In the case you are describing, dh-nss is doing the right thing in not
adding the `systemd` module to the `shadow` DB. The rationale behind
this is: "the fact that the `systemd` module is mentioned in
nsswitch.conf means that the sysadmin knew about the `systemd` module.
The fact that it does not appear in line for the shadow DB means that
the sysadmin decided not to enable it for the shadow DB, so I will leave
it alone".

This is a slightly different issue that is better solved upstream by the
(upcoming?) introduction of nsswitch.conf dropins (see
<https://bugzilla.suse.com/show_bug.cgi?id=1215487>), a feature will
also make it possible to deprecate dh-nss (that has always been thought
as a band-aid measure: maintscripts should not modify configuration files).

Regards,