Based on common/Mapping.cc · master · dss / eos · GitLab it looks like only the local password file (or NIS/LDAP) can be used. This is an unfortunate complication for a container-based deployment, where the containers should be stateless and local user accounts don’t have much significance.
I found that if I did the local account creation first, then eos vid map, the VID mappings show a user name:
# eos vid ls
publicaccesslevel: => 1024
sss:"<pwd>":gid => root
sss:"<pwd>":uid => root
sudoer => uids(daemon)
tokensudo => always
voms:"/atlas/ca:":gid => atcan
voms:"/atlas/ca:":uid => atcan
voms:"/atlas:":gid => atlas
voms:"/atlas:":uid => atlas
and eos whoami works:
bash-5.1$ eos whoami
Virtual Identity: uid=6000 (6000) gid=6000 (6000) [authz:gsi] host=node domain=domain
but the local user name is still not used in the final output, and also not relevant in the context of grid computing. So it would be nice if local user account management and synchronization could be avoided altogether, so only numeric UIDs and GIDs would be needed.