Or, take a page from the Windows book and reboot the node after joining a domain. Likely there are other services and processes outside of puppet that need to restart in order to pick up the nsswitch changes. The

reboot

resource gets that all in one operation.