What must be added to nsswitch.conf to show AD users and groups?

This is a follow-up to this question . I have a CentOS 7 machine which has joined a domain FOOBAR. It is possible to successfully get info about users stored in the AD via id user@FOOBAR.GLOBAL However, getent passwd and getent group do not show users and group defined in the AD. These are the relevant lines in /etc/nsswitch.conf: passwd: files sss shadow: files sss group: files sss What needs to be added there?