URL:
https://github.com/SSSD/sssd/pull/39
Title: #39: RESPONDER: Enable sudoRule in case insen. domains
celestian commented:
"""
Hi Fabiano,
I wrote about it a bit with @jhrozek a I discussed it with @pbrezina today. Unfortunately
on separate channels.
Resume:
1. (sssd-1-13) We are able to find proper sudoRules but login name could defer from
sudoUser attribute. For examle you can have sudoUser = Administrator@domain, but login
name is administrator@domain.
This patch fixes it. If we found proper sudoRule we add value 'ALL' to the
sudoUser attribute and return it via responder. So login name administator@... goes down
well with 'ALL' value.
How @pbrezina said just a while ago it is not sufficient fix because sudoRules work with
netgroups too and my solution doesn't => I need fix it better.
2. There is patch set from @pbrezina which enables 'cache_req' for sudo responder.
This patch set handles the issue 1. in right way but we don't use 'cache_req'
in sssd-1-13 almost. So we are not about to back port it right now.
3. (sssd-1-14) We get login name (administrator@...) but we are not able to find proper
sudoRules because there could be in other form (Administator@...). For that case I would
like to ensure that we search user in both attributes -- name and nameAlias. And this will
be in another PR.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/39#issuecomment-251921140