We supprot group merging at glibc level so that different NSS providers can complement each other. For RHEL IdM this is documented, for example, here: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/managing_idm_users_groups_hosts_and_access_control_rules/managing-user-groups-in-idm-cli_managing-users-groups-hosts#enabling-group-merging-for-local-and-remote-groups-in-idm_managing-user-groups-in-idm-cli

The instructions in RHEL IdM documentation talk about modifying nsswitch.conf. It would be best if this modification would be part of authselect's feature for profiles – at least for SSSD profile.