On Tue, Jan 31, 2017 at 10:02:04PM -0000, mdiorio(a)gmail.com wrote:
So I created a sudo Rule in AD for full access for domain
administrators. I can see that sssd is actually finding and getting the sudo rules. I
have tried a few different things for sudoUser but nothing seems to be matching.
cn=fullaccess
sudoCommand=ALL
sudoHost=ALL
sudoUser= Have tried
%INTERNAL\\Domain\ Admins
%Domain Admins@internal
%Domain\20Admins@internal
Nothing seems to be matching.
Please check with ldbsearch how the sudo rules are stored in the cache.
I'm not sure about any other way of checking why the query didn't match.
I hope I was not wrong earlier about escaping or that we don't have any
bug with escaping spaces, but perhaps can you try with a sudoUser value
that doesn't have any space in it to make the test case 'easier' ?
>
>
>
> -------------------------------
> (Tue Jan 31 16:52:19 2017) [sssd[sudo]] [sudosrv_fetch_rules] (0x0400): Retrieving
rules for [a-mdiorio@internal@internal]
> (Tue Jan 31 16:52:19 2017) [sssd[sudo]] [sudosrv_query_cache] (0x0200): Searching
sysdb with
[(&(objectClass=sudoRule)(|(sudoUser=ALL)(sudoUser=a-mdiorio@internal)(sudoUser=#1002201106)(sudoUser=%Allowed\20RODC\20Password\20Replication\20Group@internal)(sudoUser=%Hosting_NetScaler_SuperUsers@internal)(sudoUser=%DB\20GreatPlains\20Admin@internal)(sudoUser=%NetScaler_SuperUsers@internal)(sudoUser=%USE5_SVN_FullAccess@internal)(sudoUser=%S-1-5-21-1675524420-526404074-825688854-9109@oldDomain.net)(sudoUser=%Enterprise\20Admins@internal)(sudoUser=%SQL\20Server\20Admins@internal)(sudoUser=%USE5_NetAppAdmins@internal)(sudoUser=%VI\20Administrators@internal)(sudoUser=%EDCMS_SQL_Admins@internal)(sudoUser=%DSBF_SQL_Admins@internal)(sudoUser=%EDPF_SQL_Admins@internal)(sudoUser=%Data\20Warehouse@internal)(sudoUser=%EDT_SQL_Admins@internal)(sudoUser=%GLS_SQL_Admins@internal)(sudoUser=%Backup\20Access@internal)(sudoUser=%DS_SQL_Admins@internal)(sudoUser=%Domain\20Admins(a)internal)(sudoUser=%NetApp-
>
Admins@internal)(sudoUser=%NetworkAdmins@internal)(sudoUser=%Schema\20Admins@internal)(sudoUser=%Domain\20Users@internal)(sudoUser=%SCCM_Admins@internal)(sudoUser=%CTX_Admins@internal)(sudoUser=%ESX\20Admins@internal)(sudoUser=%SQL_Admins@internal)(sudoUser=%UCS-Admins@internal)(sudoUser=%ConfigMgr\20Remote\20Control\20Users@internal)(sudoUser=%Denied\20RODC\20Password\20Replication\20Group@internal)(sudoUser=%Backup\20Access@oldDomain.net)(sudoUser=%S-1-5-21-1675524420-526404074-825688854-15027@oldDomain.net)(sudoUser=%SQL\20Server\20Admins@oldDomain.net)(sudoUser=%Data\20Warehouse@oldDomain.net)(sudoUser=%DB\20GreatPlains\20Admin@oldDomain.net)(sudoUser=%Domain\20Users(a)internal)))]
> (Tue Jan 31 16:52:19 2017) [sssd[sudo]] [sudosrv_cached_rules_by_user] (0x0400):
Replacing sudoUser attribute with sudoUser: #1002201106
> (Tue Jan 31 16:52:19 2017) [sssd[sudo]] [sudosrv_query_cache] (0x0200): Searching
sysdb with
[(&(objectClass=sudoRule)(sudoUser=+*)(!(|(sudoUser=ALL)(sudoUser=a-mdiorio@internal)(sudoUser=#1002201106)(sudoUser=%Allowed\20RODC\20Password\20Replication\20Group@internal)(sudoUser=%Hosting_NetScaler_SuperUsers@internal)(sudoUser=%DB\20GreatPlains\20Admin@internal)(sudoUser=%NetScaler_SuperUsers@internal)(sudoUser=%USE5_SVN_FullAccess@internal)(sudoUser=%S-1-5-21-1675524420-526404074-825688854-9109@oldDomain.net)(sudoUser=%Enterprise\20Admins@internal)(sudoUser=%SQL\20Server\20Admins@internal)(sudoUser=%USE5_NetAppAdmins@internal)(sudoUser=%VI\20Administrators@internal)(sudoUser=%EDCMS_SQL_Admins@internal)(sudoUser=%DSBF_SQL_Admins@internal)(sudoUser=%EDPF_SQL_Admins@internal)(sudoUser=%Data\20Warehouse@internal)(sudoUser=%EDT_SQL_Admins@internal)(sudoUser=%GLS_SQL_Admins@internal)(sudoUser=%Backup\20Access@internal)(sudoUser=%DS_SQL_Admins@internal)(sudoUser=%Domain\20Admins(a)internal)(su
>
doUser=%NetApp-Admins@internal)(sudoUser=%NetworkAdmins@internal)(sudoUser=%Schema\20Admins@internal)(sudoUser=%Domain\20Users@internal)(sudoUser=%SCCM_Admins@internal)(sudoUser=%CTX_Admins@internal)(sudoUser=%ESX\20Admins@internal)(sudoUser=%SQL_Admins@internal)(sudoUser=%UCS-Admins@internal)(sudoUser=%ConfigMgr\20Remote\20Control\20Users@internal)(sudoUser=%Denied\20RODC\20Password\20Replication\20Group@internal)(sudoUser=%Backup\20Access@oldDomain.net)(sudoUser=%S-1-5-21-1675524420-526404074-825688854-15027@oldDomain.net)(sudoUser=%SQL\20Server\20Admins@oldDomain.net)(sudoUser=%Data\20Warehouse@oldDomain.net)(sudoUser=%DB\20GreatPlains\20Admin@oldDomain.net)(sudoUser=%Domain\20Users(a)internal))))]
> (Tue Jan 31 16:52:19 2017) [sssd[sudo]] [sudosrv_fetch_rules] (0x0400): Returning 0
rules for [a-mdiorio@internal@internal]
> (Tue Jan 31 16:52:19 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): error:
[0]
> (Tue Jan 31 16:52:19 2017) [sssd[sudo]] [sudosrv_build_response] (0x2000): rules_num:
[0]
> (Tue Jan 31 16:52:21 2017) [sssd[sudo]] [client_recv] (0x0200): Client disconnected!
> (Tue Jan 31 16:52:21 2017) [sssd[sudo]] [client_close_fn] (0x2000): Terminated client
[0x7f150b43d090][20]
>
> --------------------------------
> _______________________________________________
> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org