fetch nss groups when special group _nss is specified