Description of problem:
The nss option entry_cache_nowait_percentage has no impact on netgroup lookups. Similar to bug 822236. To understand and reproduce this issue, follow the steps:

1. Set entry_cache_nowait_percentage = 50 in the [nss] section of sssd.conf
2. Set entry_cache_timeout = 20 in the [domain/DOMAINNAME] section of sssd.conf
3. Create a valid netgroup entry in LDAP.
4. Purge your cache and restart sssd (to ensure clean starting state)
5. Run the following loop:

for i in {1..10}
do
/usr/bin/time --output=/tmp/time.out -f "%e" getent netgroup netgrp_nowait
cat /tmp/time.out
sleep 6
done

Actual Results:
netgrp_nowait         (host1,kau10,example.com)
0.29
netgrp_nowait         (host1,kau10,example.com)
0.01
netgrp_nowait         (host1,kau10,example.com)
0.01
netgrp_nowait         (host1,kau10,example.com)
0.01
netgrp_nowait         (host1,kau10,example.com)
0.28
netgrp_nowait         (host1,kau10,example.com)
0.01
netgrp_nowait         (host1,kau10,example.com)
0.01
netgrp_nowait         (host1,kau10,example.com)
0.02
netgrp_nowait         (host1,kau10,example.com)
0.27
netgrp_nowait         (host1,kau10,example.com)
0.01

As you can see, the first request takes sometime (0.29 sec) to return. Loop runs in a 6 second cycle. The 2nd, 3rd and 4th attempts return instantly, but the fifth one takes approx the same time as the first lookup and the pattern repeats. The entry_cache_nowait_percentage is set to 50 (percent), so entries that come in after 10 seconds past the last cache update should be returned immediately. SSSD should update the cache on its own. 

Version-Release number of selected component (if applicable):
sssd-1.16.2-7.el7.x86_64

Additional info:
If the above results are expected then please let us know. We tested this issue on older versions as well and found similar results in RHEL-7.5 & RHEL-7.4. This bug was automated long back but we couldn't catch it on later versions. Reason being a miscalculation in grepping out the expected response time values. The loop saves the result in a file and we grepped "0." instead of "0.0" to test the responses from each lookup.