[SSSD] Fwd: [sudo-users] objectClass=sudoRule vs objectClass=sudoRole in AD

JR Aquino JR.Aquino at citrix.com
Fri Oct 11 20:00:21 UTC 2013


This was asked in the SUDO-users mailing list today.

It seemed like something important to cover in here as well.

From: <Curtis.CTR.Roze at faa.gov<mailto:Curtis.CTR.Roze at faa.gov>>
Subject: [sudo-users] objectClass=sudoRule vs objectClass=sudoRole in AD
Date: October 11, 2013 5:53:44 AM PDT
To: <sudo-users at sudo.ws<mailto:sudo-users at sudo.ws>>

How does the query for sudo rules in AD even work when the debug shows a
query such as:

(&(objectClass=sudoRule)(|(sudoUser=ALL)(sudoUser=test.user)(sudoUser=#1215014110)(sudoUser=%test_rmm_linux_users)(sudoUser=%Domain
Users)(sudoUser=%Domain Users)(sudoUser=+*)))

If I execute this on the command line using ldapsearch I get no results.

If I change objectClass to objectClass=sudoRole in the same seach,
ldapsearch works perfectly.

I created the sudoers ou and objects using the guidance in the sudoers
documentation on sudo.ws.

Thanks for the insight.

Curtis Roze
____________________________________________________________
sudo-users mailing list <sudo-users at sudo.ws<mailto:sudo-users at sudo.ws>>
For list information, options, or to unsubscribe, visit:
http://www.sudo.ws/mailman/listinfo/sudo-users




More information about the sssd-devel mailing list