[SSSD] [PATCHES] sudo failing for ad trusted user in IPA environment

Pavel Březina pbrezina at redhat.com
Mon Nov 12 13:47:01 UTC 2012


On 11/11/2012 04:29 AM, Simo Sorce wrote:
> On Fri, 2012-11-09 at 14:28 +0100, Pavel Březina wrote:
>> [PATCH 4/6]
>> solves 2
>>

Hi,

> Sorry, but I fail to understand why the sudo client needs to know about
> sssd domains at all.
> I am guilty of not having followed the original sudo patches submission
> process, but without knowing if there is a valid reason it seem to me
> that sudo should not know about domains at all.

Sudo is sending two subsequent requests to sssd:
- for a specific rule named cn=defaults, which contains global options
- for rules that match specific user

We need to ensure that both requests are served from the same cache.

Originally, we served cn=defaults request from the first cache 
containing some sudo rules and then user-rules request from cache that 
contains this user. This was obviously a security bug in multidomain 
environment so we prohibited to use this protocol (version 0) at all.

Now (since version 1) we match user to domain during cn=defaults request 
and send it back to sudo so we can match the user to the same domain 
during the second request.

https://fedorahosted.org/sssd/ticket/1239

> Also by looking at the code I see that you make wrong assumptions about
> the format of a fully qualified name in sudo.
> It seem you assume a fully qualified name is always username at domain, but
> that's just the 'default' setting, the fully qualified name format is an
> option that admins can change, and the sudo client have no way to know
> what that is.

Yes, I realized that with this ticket and it is no longer an issue with 
this patch. The domain name is now sent as a separate field.

>
> I think before I allow to further change this protocol I need to
> understand why it is transporting the domain name at all.
>
> Simo.
>




More information about the sssd-devel mailing list