Thank you to the developers (who I'm guessing may be on here) and those that replied
in this thread for helping make sense of all this. A summary from an update from Red Hat
There is no need to switch ID mapping mechanism in use at all.
For quite some years SSSD already provides idmap module for winbindd that queries SSSD for
SID/name translation. Thus, there is *no* need to use something like 'idmap_rid'
when idmap_sss is available and SSSD is in use already.
We hope this makes it clear that in case idmap_sss is used, winbind is *not* responsible
for the ID mapping but instead leverages SSSD for this task.
Please note, there is a bug in the current version of 'idmap_sss' man page (BZ
for more detail on this issue.
I've suggested that the RHEL 7 WINDOWS INTEGRATION GUIDE and RHEL 7 SYSTEM
ADMINISTRATOR'S GUIDE might need tweaks to reflect this which still suggest SSSD and
winbind (hence now also Samba) are mutually exclusive.