Properly configure nsswitch.conf when using the --no-sssd option.
    
    Even with --no-sssd authconfig was setting nsswitch.conf to use sssd
    for users, groups, shadow and netgroups. We need to pass in the
    --enableforcelegacy option hwen configuring nss_ldap.
    
    Also always back up and restore sssd.conf. It still gets configured for
    kerberos.
    
    ticket 1142