So I've extended my AD and created a sudoRole in an OU, and can get it to work for a
single user. I can't however get it to work with an AD group.
I've tried %<adgroupname>, <adgroupname>, and +<adgroupname> all in
the sudoUser attribute on the object, but cannot get it to use the group. Getent group
<adgroupname> returns members. Reading the Sudoers LDAP Manual has this to say for
sudoUser:
"A user name, user ID (prefixed with '#'), Unix group name or ID (prefixed
with '%' or '%#' respectively), user netgroup (prefixed with '+'),
or non-Unix group name or ID (prefixed with '%:' or '%:#' respectively).
User netgroups are matched using the user and domain members only; the host member is not
used when matching. Non-Unix group support is only available when an appropriate
group_plugin is defined in the global defaults sudoRole object."
So is it reasonable to assume the last sentence is tripping this up? Does a group_plugin
need to be defined in defaults? What group_plugin needs to be defined in defaults? It all
works fine with just a single user in the sudoUser attribute. Once I replace it with
%<adgroupname>, the same way I put it in the sudoers file manually, it fails to
match the rule.
From sssd_sudo.log
When just my user is listed specifically in the sudoUser attribute in the sudoRole object
in AD:
[sudosrv_get_sudorules_query_cache] (0x0200):Searching sysdb with
[(&(objectClass=sudoRule)(|(sudoUser=ALL)(sudoUser=myaduser)(sudoUser=#1165)(sudoUser=%Domain\20Users)(sudoUser=%<adgroupname1>)(sudoUser=%<adgroupname2>)(sudoUser=%<adgroupnameiwanttouse>)
...
[sort_sudo_rules] (0x0400): Sorting rules with higher-wins logic
[sudosrv_get_sudorules_from_cache] (0x0400): Returning 1 rules for
[myaduser(a)mydomain.com]
When a group my user is in, is in the sudoUser attribute in the sudoRole object in AD:
[sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with
[(&(objectClass=sudoRule)(|(sudoUser=ALL)(sudoUser=myaduser)(sudoUser=#1165)(sudoUser=%Domain\20Users)(sudoUser=%<adgroupname1>)(sudoUser=%<adgroupname2>)(sudoUser=%<adgroupnameiwanttouse>)
...
[sudosrv_get_sudorules_from_cache] (0x0400): Returning 0 rules for
[myaduser(a)mydomain.com]
I've tried matching case with the filter that's in sssd_sudo.log, I've tried
matching case from id $user, nothing seems to work but listing my user account
specifically. Is there some magic to getting AD groups to work with SUDO LDAP objects?
Todd