[SSSD] [PATCHES] sudo failing for ad trusted user in IPA environment

Simo Sorce simo at redhat.com
Sun Nov 11 03:29:39 UTC 2012


On Fri, 2012-11-09 at 14:28 +0100, Pavel Březina wrote:
> [PATCH 4/6]
> solves 2
> 
Sorry, but I fail to understand why the sudo client needs to know about
sssd domains at all.
I am guilty of not having followed the original sudo patches submission
process, but without knowing if there is a valid reason it seem to me
that sudo should not know about domains at all.

Also by looking at the code I see that you make wrong assumptions about
the format of a fully qualified name in sudo.
It seem you assume a fully qualified name is always username at domain, but
that's just the 'default' setting, the fully qualified name format is an
option that admins can change, and the sudo client have no way to know
what that is.

I think before I allow to further change this protocol I need to
understand why it is transporting the domain name at all.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list