In message <Pine.LNX.4.61.0606212152500.7825@m24s24.vlinux.de>Hubert Feyrer writes
>On Wed, 21 Jun 2006, Stephen M. Jones wrote:
>> This has resolved my issue without any adverse affects.  I'm not exactly
>> clear on what the trade off is on either configuration.  

"compat" lets you use {-,+}{name@netgroup}.  non-compat offers
source-by-source lookup or substititution.  Non-compat is thus less
granular: you can't exclude specific users or groups (though for
passwords, you could set the local-passwd passwd filed to "*")

Oh, and the non-compat nsswitch code doesn't grok netgroups (though
I'd hope no-one acutally uses netgroups).



>>As noted by
>> others, there definitely is a bug with the default option which surfaces
>> with larger installations running 3.x.  For now, I'm fine with the second
>> config option, which seems to work as expected.
>
>I wonder if we shoulad add this into the BUGS section of nsswitch.conf.5 
>(unless someone's gonna fix the 'compat' code)...

Nah, let's just fix it. It's a regression: 2.x got this aspect correct.