[SSSD] [PATCHES] sudo failing for ad trusted user in IPA environment

Pavel Březina pbrezina at redhat.com
Fri Nov 9 13:28:16 UTC 2012


https://fedorahosted.org/sssd/ticket/1616

There where three main issues.

1. sssd_sudo didn't support subdomains at all

2. sudo sends two request - for default options and for rules
    We match user with domain in default options request and send the
    domain name back to sudo. Sudo sends it back to us in the form
    "user at domain" in rules request.

    If the username already contains domain name (subdomain case), sudo
    sent us "user at domain@domain". I fixed this by changing the protocol.
    Sudo sends user and domain separately now. The old protocol is also
    supported, but a debug message is printed that it will not work with
    subdomains.

3. subdomain users are stored in cn=subdomain,cn=sysdb, but rules are
    stored in cn=ipadomain,cn=sysdb. I'm using subdomain sysdb context
    for user lookups and ipadomain sysdb context for rules lookups.

[PATCH 1/6]
fix missing parameter in two debug messages

[PATCH 2/6]
use tmp_ctx in sudosrv_get_sudorules_from_cache()

[PATCH 3/6]
solves 1 and 3

[PATCH 4/6]
solves 2

[PATCH 5/6]
bumps libsss_sudo version

[PATCH 6/6]
adds useful debugging info
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-sudo-fix-missing-parameter-in-two-debug-messages.patch
Type: text/x-patch
Size: 1027 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20121109/8e2b8400/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-use-tmp_ctx-in-sudosrv_get_sudorules_from_cache.patch
Type: text/x-patch
Size: 4796 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20121109/8e2b8400/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-sudo-support-users-from-subdomains.patch
Type: text/x-patch
Size: 16912 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20121109/8e2b8400/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0004-sudo-allow-fully-qualified-user-name.patch
Type: text/x-patch
Size: 12825 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20121109/8e2b8400/attachment-0003.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0005-libsss_sudo-bump-version-to-2-1-1.patch
Type: text/x-patch
Size: 893 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20121109/8e2b8400/attachment-0004.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0006-sudo-print-how-many-rules-we-are-refreshing-or-retur.patch
Type: text/x-patch
Size: 1746 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20121109/8e2b8400/attachment-0005.bin>


More information about the sssd-devel mailing list