You have a support ticket: "shaun can log in but can't sudo." You grep shaun /etc/passwd. Nothing. You grep shaun /etc/group. Nothing. But he's logged in right now. Because your box speaks LDAP, or SSSD, or systemd-userdb, or nis, or all four — and /etc/nsswitch.conf is the traffic cop. grep only knows flat files. getent knows everything glibc knows.

The basics. Any NSS database, any key:

getent passwd shaun        # resolve user via *all* NSS sources
getent passwd 1000         # or by uid
getent group wheel         # group members, wherever they come from
getent hosts google.com    # /etc/hosts + DNS + mDNS, ordered by nsswitch.conf
getent services 22/tcp     # what claims port 22?
getent shadow shaun        # if you're root and shadow is nss-enabled

Enumerate the whole database. Give a database with no key and you get the lot — same as walking /etc/passwd, except this actually includes your 40,000 LDAP users:

getent passwd | wc -l      # every account glibc can see
getent group  | awk -F: '$4 ~ /shaun/ {print $1}'   # every group containing shaun

The one flag nobody remembers: -s SOURCE. Restrict the lookup to a single NSS backend, which is how you actually debug NSS problems:

getent -s files passwd shaun    # only /etc/passwd
getent -s sss   passwd shaun    # only SSSD
getent -s ldap  passwd shaun    # only LDAP (via nss-ldap)
getent -s systemd passwd shaun  # only systemd-userdb / DynamicUser= accounts

Ticket resolved in three commands: -s files misses, -s sss hits, id shaun shows he lacks wheel because his SSSD group memberships are wrong. You never had to touch ldapsearch.

Host resolution the way libc does it. dig lies to you: it hits DNS directly, ignoring /etc/hosts, mdns, and your nsswitch.conf order. getent uses the same call path as curl, ssh, and every other program on your box:

getent hosts    printer.local        # respects mdns_minimal in nsswitch
getent ahosts   dual-stack.example.  # getaddrinfo() — both A and AAAA
getent ahostsv4 example.com          # v4 only

When someone swears their app can't reach a host that dig resolves fine, getent ahosts is the first thing to run. It'll expose the missing search domain, the broken /etc/hosts line, or the fact that files is listed after dns.

Supplementary groups without the lie. id shaun only shows groups id can see. getent initgroups shaun asks NSS the same question setgroups(2) asks at login — which is why a freshly-added LDAP group won't show up in id for existing sessions but will show up here:

getent initgroups shaun
# shaun 1000 27 100 998 4242

The obscure databases that pay off once a year.

getent netgroup engineering    # NIS netgroups, still alive in fossil environments
getent ethers  aa:bb:cc:dd:ee:ff  # MAC → hostname if you populate /etc/ethers
getent rpc     nfs               # RPC program numbers, when portmap acts up
getent protocols icmp            # /etc/protocols with NSS semantics

Shipped with glibc. Zero dependencies. Been there since the 90s. Nobody teaches it.