[SSSD] Fwd: [sudo-users] objectClass=sudoRule vs objectClass=sudoRole in AD

Pavel Březina pbrezina at redhat.com
Mon Oct 14 08:41:46 UTC 2013


On 10/12/2013 04:43 PM, JR Aquino wrote:
> This feels like a valid bug/typo.
>
> I think it may be worth a ticket

Hi,
Benjamin is correct that it is a query to SSSD cache (sysdb). LDAP 
attributes are mapped to sysdb attributes on the fly. Sysdb schema 
doesn't necessarily have to correspond with LDAP schema.

I don't recall specifically whether this was a design decision or it is 
a typo, although the way how I feel it now, I think it is a design 
decision since we always refer to sudo "rules" not "roles".

I don't think it is something that should be changed.

>
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> Jr Aquino | Sr. Information Security Specialist
> GIAC | Certified Incident Handler
> GIAC | WebApp Penetration Tester
> GXPN | GIAC Advanced Penetration Tester and Exploit Researcher
> Citrix Online | 7408 Hollister Avenue | Goleta, CA 93117
> T:  +1 805.690.3478
> C: +1 805.717.0365
> jr.aquino at citrixonline.com<mailto:jr.aquino at citrixonline.com>
> http://www.citrixonline.com
>
> On Oct 11, 2013, at 11:54 PM, "Benjamin Franzke" <benjaminfranzke at googlemail.com<mailto:benjaminfranzke at googlemail.com>> wrote:
>
>  From a quick grep:
>
> src/providers/ldap/ldap_opts.h:310
> struct sdap_attr_map native_sudorule_map[] = {
>      { "ldap_sudorule_object_class", "sudoRole", SYSDB_SUDO_CACHE_OC, NULL },
>
> sudoRole is mapped to SYSDB_SUDO_CACHE_OC, which is:
>
> src/db/sysdb_sudo.h:36
> #define SYSDB_SUDO_CACHE_OC            "sudoRule"
>
> So the query you're seeing seems to be a query to the cache (local sysdb).
>
> Dont know though whether that is a typo or really wanted,
> i dont have much insight as well.
>
>
> 2013/10/11 JR Aquino <JR.Aquino at citrix.com<mailto:JR.Aquino at citrix.com>>
> This was asked in the SUDO-users mailing list today.
>
> It seemed like something important to cover in here as well.
>
> From: <Curtis.CTR.Roze at faa.gov<mailto:Curtis.CTR.Roze at faa.gov><mailto:Curtis.CTR.Roze at faa.gov<mailto:Curtis.CTR.Roze at faa.gov>>>
> Subject: [sudo-users] objectClass=sudoRule vs objectClass=sudoRole in AD
> Date: October 11, 2013 5:53:44 AM PDT
> To: <sudo-users at sudo.ws<mailto:sudo-users at sudo.ws><mailto:sudo-users at sudo.ws<mailto:sudo-users at sudo.ws>>>
>
> How does the query for sudo rules in AD even work when the debug shows a
> query such as:
>
> (&(objectClass=sudoRule)(|(sudoUser=ALL)(sudoUser=test.user)(sudoUser=#1215014110)(sudoUser=%test_rmm_linux_users)(sudoUser=%Domain
> Users)(sudoUser=%Domain Users)(sudoUser=+*)))
>
> If I execute this on the command line using ldapsearch I get no results.
>
> If I change objectClass to objectClass=sudoRole in the same seach,
> ldapsearch works perfectly.
>
> I created the sudoers ou and objects using the guidance in the sudoers
> documentation on sudo.ws<http://sudo.ws>.
>
> Thanks for the insight.
>
> Curtis Roze
> ____________________________________________________________
> sudo-users mailing list <sudo-users at sudo.ws<mailto:sudo-users at sudo.ws><mailto:sudo-users at sudo.ws<mailto:sudo-users at sudo.ws>>>
> For list information, options, or to unsubscribe, visit:
> http://www.sudo.ws/mailman/listinfo/sudo-users
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org<mailto:sssd-devel at lists.fedorahosted.org>
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>




More information about the sssd-devel mailing list