I am running:
sssd.x86_64: 1.9.2-82.4.el6_4
On scientific linux 6.4.
I do not have sssd and sudo integration because sudo is not available in
our AD/ldap provided by the university. I have added a couple
usernames unto the local sudoers file. I also haven't set any of the
sudo options in my sssd.conf
I set to use local files only for sudo in nsswitch
sudoers: files
However, whenever i call sudo as a user authenticated through sssd, sssd
reaches out and does tons ( at least 54 ) of ldap searches, which return
empty because sudo does not exist in the ldap, then i can eventually
enter my password and use sudo.
Here's a section of my sssd log. When this returns that "ldap_result
found nothing" i can enter my password to proceed with local sudo.
(Thu Dec 19 11:12:22 2013) [sssd[be[default]]]
[sdap_get_groups_next_base] (0x0400): Searching for groups with base
[DC=dhe,DC=duke,DC=edu]
(Thu Dec 19 11:12:22 2013) [sssd[be[default]]]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(&(objectSID=S-edited)(objectclass=group)(name=*))][DC=dhe,DC=duke,DC=edu].
(Thu Dec 19 11:12:22 2013) [sssd[be[default]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass]
(Thu Dec 19 11:12:22 2013) [sssd[be[default]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [name]
(Thu Dec 19 11:12:22 2013) [sssd[be[default]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber]
(Thu Dec 19 11:12:22 2013) [sssd[be[default]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [member]
(Thu Dec 19 11:12:22 2013) [sssd[be[default]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectGUID]
(Thu Dec 19 11:12:22 2013) [sssd[be[default]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectSID]
(Thu Dec 19 11:12:22 2013) [sssd[be[default]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [whenChanged]
(Thu Dec 19 11:12:22 2013) [sssd[be[default]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uSNChanged]
(Thu Dec 19 11:12:22 2013) [sssd[be[default]]]
[sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 54
(Thu Dec 19 11:12:22 2013) [sssd[be[default]]] [sdap_process_result]
(0x2000): Trace: sh[0x21309c0], connected[1], ops[0x2563870],
ldap[0x265b420]
(Thu Dec 19 11:12:22 2013) [sssd[be[default]]] [sdap_process_result]
(0x2000): Trace: sh[0x21309c0], connected[1], ops[0x2563870],
ldap[0x265b420]
(Thu Dec 19 11:12:22 2013) [sssd[be[default]]] [sdap_process_result]
(0x2000): Trace: sh[0x21309c0], connected[1], ops[0x2563870],
ldap[0x265b420]
(Thu Dec 19 11:12:22 2013) [sssd[be[default]]] [sdap_process_result]
(0x2000): Trace: sh[0x21309c0], connected[1], ops[0x2563870],
ldap[0x265b420]
(Thu Dec 19 11:12:22 2013) [sssd[be[default]]] [sdap_process_result]
(0x2000): Trace: sh[0x21309c0], connected[1], ops[0x2563870],
ldap[0x265b420]
(Thu Dec 19 11:12:22 2013) [sssd[be[default]]] [sdap_process_result]
(0x2000): Trace: sh[0x21309c0], connected[1], ops[0x2563870],
ldap[0x265b420]
(Thu Dec 19 11:12:22 2013) [sssd[be[default]]]
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no
errmsg set
(Thu Dec 19 11:12:22 2013) [sssd[be[default]]] [sdap_get_groups_process]
(0x0400): Search for groups, returned 0 results.
(Thu Dec 19 11:12:22 2013) [sssd[be[default]]] [acctinfo_callback]
(0x0100): Request processed. Returned 0,0,Success
(Thu Dec 19 11:12:22 2013) [sssd[be[default]]] [sdap_process_result]
(0x2000): Trace: sh[0x21309c0], connected[1], ops[(nil)], ldap[0x265b420]
(Thu Dec 19 11:12:22 2013) [sssd[be[default]]] [sdap_process_result]
(0x2000): Trace: ldap_result found nothing!
How can i prevent these queries and just use the local sudoers files as
indicated in nsswitch?
thank,
-Chris