[SSSD] [PATCHES] sudo failing for ad trusted user in IPA environment

Sumit Bose sbose at redhat.com
Wed Nov 14 10:02:14 UTC 2012


On Tue, Nov 13, 2012 at 03:53:43PM +0100, Pavel Březina wrote:
> On 11/12/2012 02:33 PM, Pavel Březina wrote:
> >On 11/09/2012 03:18 PM, Simo Sorce wrote:
> >>On Fri, 2012-11-09 at 14:28 +0100, Pavel Březina wrote:
> >>> From 724ebcafa2d4e54df048ca2a578b03281fb7fe6f Mon Sep 17 00:00:00 2001
> >>>From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina at redhat.com>
> >>>Date: Fri, 9 Nov 2012 13:31:52 +0100
> >>>Subject: [PATCH 1/6] sudo: fix missing parameter in two debug messages
> >>>
> >>>---
> >>>  src/responder/sudo/sudosrv_get_sudorules.c | 2 +-
> >>>  1 file changed, 1 insertion(+), 1 deletion(-)
> >>>
> >>>diff --git a/src/responder/sudo/sudosrv_get_sudorules.c
> >>>b/src/responder/sudo/sudosrv_get_sudorules.c
> >>>index
> >>>b6e016c73cba6c86b9f20af63357c6fcc2b5508b..0e0437622e94a234b1597bcd272633f6944d4762
> >>>100644
> >>>--- a/src/responder/sudo/sudosrv_get_sudorules.c
> >>>+++ b/src/responder/sudo/sudosrv_get_sudorules.c
> >>>@@ -369,7 +369,7 @@ errno_t sudosrv_get_rules(struct sudo_cmd_ctx
> >>>*cmd_ctx)
> >>>                                     NULL, &groupnames);
> >>>      if (ret != EOK) {
> >>>          DEBUG(SSSDBG_CRIT_FAILURE,
> >>>-             ("Unable to retrieve user info [%d]: %s\n",
> >>>strerror(ret)));
> >>>+             ("Unable to retrieve user info [%d]: %s\n", ret,
> >>>strerror(ret)));
> >>>          goto done;
> >>>      }
> >>
> >>The comment says 2 debug messages, but the patch only has one, which is
> >>wrong ?
> >>
> >>Simo.
> >>
> >
> >Hi,
> >thank you. Looks like I forgot to modify the second message. New patches
> >are attached.
> 
> I'm attaching a new set of patches base on IRC discussion with Simo
> and Jakub.
> 
> Domain name is no longer sent to sudo. This was done without
> changing the protocol.
> 

I just checked the handling of subdomain users in patch 0003 and it
looks good to me. Rules for subdomain users are always searched in the
parent domain.

bye,
Sumit



More information about the sssd-devel mailing list