On Tue, Jan 31, 2017 at 05:06:30PM -0000, mdiorio(a)gmail.com wrote:
> On Mon, Jan 30, 2017 at 06:45:19PM -0000,
mdiorio(a)gmail.com
wrote:
> Are your sudo rules stored in AD or locally in /etc/sudoers? I assume
> it's in AD, right?
Seems like this is the part I was missing. Not well explained AT ALL (or anywhere in any
documentation I have been looking at)!
I extended AD and am creating the rules now. The one thing that I'm not sure of is:
"Non-Unix group support is only available when an appropriate group_plugin is
defined in the global defaults sudoRole object."
This means that all the groups you assign to the rule must be resolvable
in the 'id' command with the vanilla sudo code.
So if I want to add an AD security group to the rule, how would that be done and is a
plugin needed?
As long as the the groups is resolvable by the client, then no. The
plugin would do the work of asserting the user is a member of the group
-- as long as the usual NSS interface can be used, no plugin is needed.
So I have a security group GS-Technology, I'd enter it as
%GS-Technology? What about group with spaces like Domain Admins? Would it be %Domain\
Admins, or do I need to do the domain too? Escaping the \?
A group name must start with a percent sign, that's how it's determined
that it's a group and not a user.
As per the name format, I agree we can document this better, feel free to
open a bug against sssd. The answer depends on the sssd version, up and
until 1.13 it would be just the short name (e.g. %GS-Technology),
starting with 1.14, the name can also be qualified
(%GS-Technology(a)your.ad.domain). The format of the 'qualified' name must
be parseable by sssd as per the re_expression command.
No escaping, that's a shell thing and has no place in LDAP.
>
> %INTERNAL\\Domain\ Admins
>
> Documentation is not very firm in this area.