[SSSD] [PATCHES] sudo failing for ad trusted user in IPA environment
Pavel Březina
pbrezina at redhat.com
Fri Nov 9 13:28:16 UTC 2012
https://fedorahosted.org/sssd/ticket/1616
There where three main issues.
1. sssd_sudo didn't support subdomains at all
2. sudo sends two request - for default options and for rules
We match user with domain in default options request and send the
domain name back to sudo. Sudo sends it back to us in the form
"user at domain" in rules request.
If the username already contains domain name (subdomain case), sudo
sent us "user at domain@domain". I fixed this by changing the protocol.
Sudo sends user and domain separately now. The old protocol is also
supported, but a debug message is printed that it will not work with
subdomains.
3. subdomain users are stored in cn=subdomain,cn=sysdb, but rules are
stored in cn=ipadomain,cn=sysdb. I'm using subdomain sysdb context
for user lookups and ipadomain sysdb context for rules lookups.
[PATCH 1/6]
fix missing parameter in two debug messages
[PATCH 2/6]
use tmp_ctx in sudosrv_get_sudorules_from_cache()
[PATCH 3/6]
solves 1 and 3
[PATCH 4/6]
solves 2
[PATCH 5/6]
bumps libsss_sudo version
[PATCH 6/6]
adds useful debugging info
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-sudo-fix-missing-parameter-in-two-debug-messages.patch
Type: text/x-patch
Size: 1027 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20121109/8e2b8400/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-use-tmp_ctx-in-sudosrv_get_sudorules_from_cache.patch
Type: text/x-patch
Size: 4796 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20121109/8e2b8400/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-sudo-support-users-from-subdomains.patch
Type: text/x-patch
Size: 16912 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20121109/8e2b8400/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0004-sudo-allow-fully-qualified-user-name.patch
Type: text/x-patch
Size: 12825 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20121109/8e2b8400/attachment-0003.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0005-libsss_sudo-bump-version-to-2-1-1.patch
Type: text/x-patch
Size: 893 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20121109/8e2b8400/attachment-0004.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0006-sudo-print-how-many-rules-we-are-refreshing-or-retur.patch
Type: text/x-patch
Size: 1746 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20121109/8e2b8400/attachment-0005.bin>
More information about the sssd-devel
mailing list