From Fedora Project Wiki

What happens if 'sudoers: sss' is in nsswitch.conf, but sssd isn't configured for it or there is no LDAP? Does it properly fall back to the file? -- notting

I haven't tested this but the proper configuration would be "sudoers: sss files" or "sudoers: files sss" depending on the order you want. We definitely need to support ordering of databases. --jhrozek