Uncle google told me to restart nscd service - it didn't help.
However stopping nscd daemon completely seems to fix the issue, when I checked user again (groups user or id user) it shown the correct, updated group membership.
Nscd manual described valuable option which helped me resolve this issue. You need to use -i (invalidate) and provide cached table name to get it updated.
After running:
nscd -i group
caching daemon started responding with up-to-date data.
In similar way you may fix hosts cache to prevent keep old dns responses:
nscd -i hosts
In similar way you may fix hosts cache to prevent keep old dns responses:
nscd -i hosts
Btw: if interested you may check what's in the current nscd database in /var/db/nscd folder. Tables stored in that folder are in binary folder so you may consider running strings on each table which you want to review.