Stephen,

Thanks for explaining ! Makes sense.
Concerning the integration of sudo with sssd, can you guestimate when it will come available ?
We are considering setting up a freeIPA server, and the sudo - sssd combo would be very convenient for us to test, so we can get rid of some legacy stuff.

cheers,
Andy


2011/4/29 Stephen Gallagher <sgallagh@redhat.com>
On Fri, 2011-04-29 at 14:21 +0200, Andy Kannberg wrote:
> Simo,
>
> What surprised me was that it also works for sudo rules that are
> delivered via LDAP.
> We don't have a local sudoers file, but all sudo rules are in LDAP.
>
> Which means, that when a users logs in on the system, the sudo rules
> for that user must be cached also by SSSD.


No, they are not cached by SSSD. Sudo itself can cache the LDAP rules
(though I don't know if it caches all rules or only those that have
previously been used) This is an internal feature of sudo.

The integration with SSSD is coming in the future so that we can provide
sudo rules from LDAP, FreeIPA or other sources with a unified interface.
I think that's where you got confused.

_______________________________________________
sssd-devel mailing list
sssd-devel@lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel