Hi!
see attached simple patch for ticket:
https://fedorahosted.org/sssd/ticket/2912
The first patch is for master and 1.13
the second for 1.12.
It seems like the decision to ignore cache
validity when background refresh is enabled
was not a good one and it was not possible
to fetch new netgroup entry even if the
old was invalidated with sss_cache.
Michal