On Fri, Sep 19, 2014 at 11:31:12AM +0300, Alexander Bokovoy wrote:
On Thu, 18 Sep 2014, Dan Lavu wrote:
>I'll go ahead and take a look at this and see if I can reproduce it or
>find a way around it. This isn't usually a problem except with AD,
>because AD is case sensitive in regards to the syntax and attribute
>name.
It is not an AD issue but rather poor choice of LDAP schema for sudo --
in the original SUDO's design sudo-related attributes have
caseExactIA5Match equality syntax.
We download all the rules to the client periodically anyway.
I had a chat with Dan K. on IRC earlier today. It seems that sudo
doesn't perform any filtering based on sudoUser, only on netgroups and
hosts.
So without prototyping anything it seems that SSSD just needs to also
match sudoUser values against user's nameAlias values, too. I filed:
https://fedorahosted.org/sssd/ticket/2446