[SSSD] [PATCHES] sudo failing for ad trusted user in IPA environment
Pavel Březina
pbrezina at redhat.com
Mon Nov 12 13:47:01 UTC 2012
On 11/11/2012 04:29 AM, Simo Sorce wrote:
> On Fri, 2012-11-09 at 14:28 +0100, Pavel Březina wrote:
>> [PATCH 4/6]
>> solves 2
>>
Hi,
> Sorry, but I fail to understand why the sudo client needs to know about
> sssd domains at all.
> I am guilty of not having followed the original sudo patches submission
> process, but without knowing if there is a valid reason it seem to me
> that sudo should not know about domains at all.
Sudo is sending two subsequent requests to sssd:
- for a specific rule named cn=defaults, which contains global options
- for rules that match specific user
We need to ensure that both requests are served from the same cache.
Originally, we served cn=defaults request from the first cache
containing some sudo rules and then user-rules request from cache that
contains this user. This was obviously a security bug in multidomain
environment so we prohibited to use this protocol (version 0) at all.
Now (since version 1) we match user to domain during cn=defaults request
and send it back to sudo so we can match the user to the same domain
during the second request.
https://fedorahosted.org/sssd/ticket/1239
> Also by looking at the code I see that you make wrong assumptions about
> the format of a fully qualified name in sudo.
> It seem you assume a fully qualified name is always username at domain, but
> that's just the 'default' setting, the fully qualified name format is an
> option that admins can change, and the sudo client have no way to know
> what that is.
Yes, I realized that with this ticket and it is no longer an issue with
this patch. The domain name is now sent as a separate field.
>
> I think before I allow to further change this protocol I need to
> understand why it is transporting the domain name at all.
>
> Simo.
>
More information about the sssd-devel
mailing list