Hello, i'm having some trouble getting sudoers to work.  

I have 5 machines joined to the FreeIPA domain and I have a user group called ops and ops_sudoers.  Both have permission to full sudo.  


[andrew.meyer@jira02 ~]$ ipa sudorule-find ALL
-------------------
1 Sudo Rule matched
-------------------
  Rule name: All
  Enabled: TRUE
  Host category: all
  Command category: all
  Sudo Option: !authenticate
----------------------------
Number of entries returned 1
----------------------------

[andrew.meyer@jira02 ~]$ ipa sudorule-show ALL
  Rule name: All
  Enabled: TRUE
  Host category: all
  Command category: all
  Users: brian.keithly, andrew.meyer
  User Groups: ops_sudoers, ops
  RunAs Users: process
  Sudo Option: !authenticate

[andrew.meyer@jira02 ~]$ sudo su -
[sudo] password for andrew.meyer:
Sorry, user andrew.meyer is not allowed to execute '/bin/su -' as root on jira02.mgt.example.net.
[andrew.meyer@jira02 ~]$

My HBAC is set to allow_all.

[root@jira02 log]# cat /etc/sssd/sssd.conf
[domain/mgt.example.net]

cache_credentials = True
krb5_store_password_if_offline = True
krb5_realm = EXAMPLE.NET
ipa_domain = mgt.example.net
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = jira02.mgt.example.net
chpass_provider = ipa
dyndns_update = True
ipa_server = _srv_, infra-test-ipa.example.net
dyndns_iface = ens160
ldap_tls_cacert = /etc/ipa/ca.crt
[sssd]
services = nss, pam, ssh, sudo

domains = mgt.example.net
[nss]
homedir_substring = /home

[pam]

[sudo]

[autofs]

[ssh]

[pac]

[ifp]

[secrets]

[root@jira02 log]#