Hi

Sorry, I forgot to include versions:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[root@client01 ~]# lsb_release -a
LSB Version:    :core-4.1-amd64:core-4.1-noarch
Distributor ID:    RedHatEnterpriseServer
Description:    Red Hat Enterprise Linux Server release 7.2 (Maipo)
Release:    7.2
Codename:    Maipo

[root@client01 ~]# rpm -qa | grep sudo
sudo-1.8.6p7-16.el7.x86_64

[root@client01 ~]# rpm -qa | grep sssd
sssd-client-1.13.0-40.el7_2.1.x86_64
sssd-krb5-common-1.13.0-40.el7_2.1.x86_64
sssd-krb5-1.13.0-40.el7_2.1.x86_64
sssd-common-1.13.0-40.el7_2.1.x86_64
sssd-common-pac-1.13.0-40.el7_2.1.x86_64
sssd-ad-1.13.0-40.el7_2.1.x86_64
sssd-ldap-1.13.0-40.el7_2.1.x86_64
sssd-1.13.0-40.el7_2.1.x86_64
python-sssdconfig-1.13.0-40.el7_2.1.noarch
sssd-ipa-1.13.0-40.el7_2.1.x86_64
sssd-proxy-1.13.0-40.el7_2.1.x86_64

[root@client01 ~]# sudo -V | grep -i version
Sudoers policy plugin version 1.8.6p7
Sudoers file grammar version 42
Sudoers I/O plugin version 1.8.6p7

[root@client01 ~]# sudo -V | grep --color sss
Opciones de configuración: --build=x86_64-redhat-linux-gnu --host=x86_64-redhat-linux-gnu --program-prefix= --disable-dependency-tracking --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc --datadir=/usr/share --includedir=/usr/include --libdir=/usr/lib64 --libexecdir=/usr/libexec --localstatedir=/var --sharedstatedir=/var/lib --mandir=/usr/share/man --infodir=/usr/share/info --prefix=/usr --sbindir=/usr/sbin --libdir=/usr/lib64 --docdir=/usr/share/doc/sudo-1.8.6p7 --with-logging=syslog --with-logfac=authpriv --with-pam --with-pam-login --with-editor=/bin/vi --with-env-editor --with-ignore-dot --with-tty-tickets --with-ldap --with-ldap-conf-file=/etc/sudo-ldap.conf --with-selinux --with-passprompt=[sudo] password for %p:  --with-linux-audit --with-sssd --with-gcrypt
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I have read these two webpages, without success. I have enabled sssd-sudo debug according to
https://fedorahosted.org/sssd/wiki/HOWTO_Troubleshoot_SUDO but I haven't found any relevant information in the LOGs (lots of messages, including successful searches, groups without members ¿?, etc.). Among all those messages, how would I filter to get the relevant ones?

Regards and thanks in advance.


2016-01-25 14:41 GMT+01:00 Lukas Slebodnik <lslebodn@redhat.com>:
On (25/01/16 14:19), Juan Asensio Sánchez wrote:
>Hi
>
>I an trying to get sudo with sssd work with Samba4 provider, but I can't. I
>have joined the domain using realmd:
>
>realm --client-software=sssd join mmdd.indra.es
>
>After that, I have modified some sssd settings, to add sudo service, enable
>enumerate (during debigging), etc.:
>
I would recommend to disable enumeration for AD provider.

>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>[sssd]
>domains = xxxx.yyyy.es
>config_file_version = 2
>services = nss, pam, sudo, ssh
>
>[sudo]
>
>[ssh]
>
>[domain/xxxx.yyyy.es]
>enumerate = True
>ad_domain = xxxx.yyyy.es
>krb5_realm = XXXX.YYYY.ES
>realmd_tags = manages-system joined-with-samba
>cache_credentials = True
>id_provider = ad
>krb5_store_password_if_offline = True
>default_shell = /bin/bash
>ldap_id_mapping = False
>use_fully_qualified_names = False
>fallback_homedir = /home/%u
>access_provider = ad
>case_sensitive = false
>
>ldap_user_ssh_public_key = sshPublicKey
>
>sudo_provider = ldap
which version of sssd do you use?
because sssd >= 1.12.0 has native AD sudo provider.

Is sudo compiled with sssd support
sh$ sudo --version | grep sss

https://jhrozek.wordpress.com/2014/07/21/add-sudo-rules-to-active-directory-and-access-them-with-sssd/

And here is a link to sudo trouble shooting wiki.
https://fedorahosted.org/sssd/wiki/HOWTO_Troubleshoot_SUDO

LS
_______________________________________________
sssd-users mailing list
sssd-users@lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org