https://fedorahosted.org/sssd/ticket/1616
There where three main issues.
1. sssd_sudo didn't support subdomains at all
2. sudo sends two request - for default options and for rules
We match user with domain in default options request and send the
domain name back to sudo. Sudo sends it back to us in the form
"user@domain" in rules request.
If the username already contains domain name (subdomain case), sudo
sent us "user@domain@domain". I fixed this by changing the protocol.
Sudo sends user and domain separately now. The old protocol is also
supported, but a debug message is printed that it will not work with
subdomains.
3. subdomain users are stored in cn=subdomain,cn=sysdb, but rules are
stored in cn=ipadomain,cn=sysdb. I'm using subdomain sysdb context
for user lookups and ipadomain sysdb context for rules lookups.
[PATCH 1/6]
fix missing parameter in two debug messages
[PATCH 2/6]
use tmp_ctx in sudosrv_get_sudorules_from_cache()
[PATCH 3/6]
solves 1 and 3
[PATCH 4/6]
solves 2
[PATCH 5/6]
bumps libsss_sudo version
[PATCH 6/6]
adds useful debugging info