Well I attempted to get this to work and I couldn't find a way. I attempted to set up
a separate domain and then modify the re_expression, however that just modifies what gets
captured into SSSD, and there is now way I can find to make a substitution. After looking
around for other options (short of modifying the code) I'm left with packaging
pam_krb5 ourselves for RHEL 8 in order to distribute it to our internal systems. I'm
certainly open to other ideas, but I can't see how to modify the username in a non
static way.
I've opened a couple of bug reports, one against sssd itseld, one against RHEL 8:
https://pagure.io/SSSD/sssd/issue/4109
https://bugzilla.redhat.com/show_bug.cgi?id=1767176
It'll be a matter of peoples opinion as to whether to fix these, I realize my employer
is in a minority by using sudo in this manner.
Thanks,
-Erinn