PS: I can reproduce the problem by setting “passwd compat files” or “passwd files files” here.
But with “[NOTFOUND=return]” being there too, I get no duplicates.
by setting those entries to “compat” I no longer see duplicate entries; I don’t know how this could happen, I never edited that file manually.
As I wrote, the lines you had are the default in Tumbleweed.
But those lines by themselves do not cause duplicates here (and I guess not on other Tumbleweed systems either, otherwise there would have been more reports of that already).
I suppose “compat” will be good enough for you, it is the default in Leap 42.2.
It is a bit strange, but in the end every system is different from the others; now everything is all right.
Thank you for your help.