On 17/06/2022 12.46, Grant Janssen wrote:
what does "sudo -l -U <username>" show?
My experience flushing sss_cache has rarely been successful.
When I experience issues with user sudo permissions, I restart sssd.
Fixes it every time.
- grant
> On Jun 17, 2022, at 00:53, Alessandro Fort via FreeIPA-users
> <freeipa-users(a)lists.fedorahosted.org> wrote:
>
> CAUTION: This email originated outside Company3-Method. Do not click
> links or open attachments unless you recognize the sender and know
> the content is safe.
>
> Hi,
>
> I have a local user (let's call it local) that has NOPASSWD set in
> /etc/sudoers. When I apply an ID view to change my FreeIPA user's (let's
> call it domain) username, UID, GID, shell and home to that of local,
> whenever I try to use sudo after logging in with either domain or local,
> domain's sudo rules apply and I am asked for a password. Is this
> expected behaviour or a quirk of my configuration/policies? I would
> expect that when logging in using domain, FreeIPA sudo rules are
> applied, while if I log in using local I'd get the old /etc/sudoers
> policy. Is this possible?
>
> Thank you!
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to
> freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
>
https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fe...
>
<
https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fe...
> List Guidelines:
>
https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorap...
>
<
https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorap...
> List Archives:
>
https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.f...
>
<
https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.f...
> Do not reply to spam on the list, report it:
>
https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpagure....
>
<
https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpagure....
With no ID view applied, sudo -l -U local shows
(ALL : ALL) ALL
(ALL) NOPASSWD: ALL
(ALL) NOPASSWD: ALL
(duplicated lines are caused by cloudinit's /etc/sudoers.d entries)
sudo -l -U domain:
(ALL : ALL) ALL
With ID view applied, they both have the same output:
(ALL : ALL) ALL
(ALL) NOPASSWD: ALL
(ALL) NOPASSWD: ALL
(ALL : ALL) ALL
So it seems they get merged. I do not think this is an SSSD cache issue,
as I also restart it to make sure changes are applied instantly.