Thank you to the developers (who I'm guessing may be on here) and those that replied
in this thread for helping make sense of all this. A summary from an update from Red Hat
below:
There is no need to switch ID mapping mechanism in use at all.
For quite some years SSSD already provides idmap module for winbindd that queries SSSD for
SID/name translation. Thus, there is *no* need to use something like 'idmap_rid'
when idmap_sss is available and SSSD is in use already.
We hope this makes it clear that in case idmap_sss is used, winbind is *not* responsible
for the ID mapping but instead leverages SSSD for this task.
Please note, there is a bug in the current version of 'idmap_sss' man page (BZ
#1652563).
Ref:
https://access.redhat.com/articles/1391423 for more detail on this issue.
I've suggested that the RHEL 7 WINDOWS INTEGRATION GUIDE and RHEL 7 SYSTEM
ADMINISTRATOR'S GUIDE might need tweaks to reflect this which still suggest SSSD and
winbind (hence now also Samba) are mutually exclusive.