does tcl have a standard way of doing NSS lookups (getpwnam, setpwent,...)
Tcl doesn't expose those as APIs (it doesn't really use them internally either) but the TclX extension package does support exactly what you want I believe. For example:
package require TclX
set uid [id convert user $tcl_platform(user)]
puts "Your userid is $uid and you are a member of these groups: [id groups]"
If you're using ActiveTcl, you've definitely got the TclX package available (either already installed or available from the teapot repository).