After converting a system to sssd with an IPA backend, we found that cron was not recognizing our users. It appears (based on using lsof to see what .so files are open) that cron is reading nsswitch.conf at startup, and doesn’t notice the change when sssd setup adds sss to the user map in nsswitch.conf. Restarting cron fixes it, but we’ve now got another Ubuntu-specific hack in our Ansible setup script.