[SSSD] [PATCH] SUDO: AD provider
Lukas Slebodnik
lslebodn at redhat.com
Fri Feb 28 10:25:47 UTC 2014
On (28/02/14 10:21), Sumit Bose wrote:
>On Thu, Feb 27, 2014 at 05:18:26PM +0100, Jakub Hrozek wrote:
>> On Thu, Feb 27, 2014 at 01:59:57PM +0100, Pavel Březina wrote:
>> > On 02/26/2014 01:54 PM, Sumit Bose wrote:
>> > >Hi,
>> > >
>> > >this patch provides the AD sudo provider and is "inspired" by Lukas'
>> > >"SUDO: IPA provider" patch.
>> > >
>> > >I do not have an AD setup with sudo rules. It would be nice if someone
>> > >with such setup can run some basic test otherwise I can/have to do some
>> > >additional testing.
>> > >
>> > >Patches for master and 1.11 are attached.
>> > >
>> > >bye,
>> > >Sumit
>> >
>> > Hi,
>> >
>> > <nitpick>
>> > - 'ad': ['id', 'auth', 'access', 'chpass'],
>> > + 'ad': ['id', 'auth', 'access', 'chpass', 'sudo', 'subdomains'],
>> >
>> > subdomains should be added in separate patch
>> > </nitpick>
>> >
>> > code-wise ack. I will try to update ad schema and test it.
>>
>> The patch works fine! ACK from my side, I'll leave it up to you whether
>> you'd like to split the patch into two or not.
>
>sure, new version attached
>
>>
>> For future reference, if you want to amend the schema, you need to copy
>> the AD schema file (/usr/share/doc/sudo/schema.ActiveDirectory) from sudo
>>
>> Then load it on AD:
>> ldifde -i -f schema.ActiveDirectory -c dc=X dc=DOMAINNAME,dc=LOCAL
>>
>> Then just add the records. I admit I was lazy and just added the
>> sudoRole objects to the same subtree as users but that doesn't matter as
>> SSSD uses the top level base anyway:
>> (Thu Feb 27 17:03:12 2014) [sssd[be[WIN.EXAMPLE.COM]]]
>> [common_parse_search_base] (0x0100): Search base added:
>> [SUDO][DC=WIN,DC=EXAMPLE,DC=COM][SUBTREE][]
>>
>> To add the records, I used "ADSI Edit". Just right-click the container,
>> select "New->Object" and then you should see sudoRole in the list of
>> objectClasses. The name of the user must be non-qualified, so from the
>> following rule:
>>
>> dn: CN=lessrule,CN=Users,DC=WIN,DC=EXAMPLE,DC=COM
>> objectClass: top
>> objectClass: sudoRole
>> cn: lessrule
>> distinguishedName: CN=lessrule,CN=Users,DC=WIN,DC=EXAMPLE,DC=COM
>> instanceType: 4
>> whenCreated: 20140226161739.0Z
>> whenChanged: 20140226163320.0Z
>> uSNCreated: 274759
>> uSNChanged: 274760
>> name: lessrule
>> objectGUID:: Q44OphStKUaZOkDR9eBs7A==
>> objectCategory: CN=sudoRole,CN=Schema,CN=Configuration,DC=WIN,DC=EXAMPLE,DC=COM
>> dSCorePropagationData: 16010101000000.0Z
>> sudoHost: ALL
>> sudoCommand: /usr/bin/less
>> sudoUser: tuser at win.example.com
>> sudoUser: Administrator
>>
>> Only Administrator worked. So I suspect that in order to support users
>> from trusted domains, you'd have to make them a member of a group and then
>> allow the rule for the group. But this is mostly academic as this
>> problem is present also with sudo using the 'built-in' LDAP support and
>> not SSSD.
>
>
>Thanks for the instructions.
>
>bye,
>Sumit
>
>> _______________________________________________
>> sssd-devel mailing list
>> sssd-devel at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>From 79514e61046a5fc184c8552103e02293573fb0df Mon Sep 17 00:00:00 2001
>From: Sumit Bose <sbose at redhat.com>
>Date: Fri, 28 Feb 2014 10:04:08 +0100
>Subject: [PATCH 1/2] config API: add missing subdomain target to AD provider
> test
>
>---
> src/config/SSSDConfigTest.py | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py
>index 7cfbddc..47e9e75 100755
>--- a/src/config/SSSDConfigTest.py
>+++ b/src/config/SSSDConfigTest.py
>@@ -731,7 +731,7 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):
> control_provider_dict = {
> 'ipa': ['id', 'auth', 'access', 'chpass', 'sudo', 'autofs',
> 'session', 'hostid', 'subdomains'],
>- 'ad': ['id', 'auth', 'access', 'chpass'],
>+ 'ad': ['id', 'auth', 'access', 'chpass', 'subdomains'],
> 'local': ['id', 'auth', 'chpass'],
> 'ldap': ['id', 'auth', 'access', 'chpass', 'sudo', 'autofs'],
> 'krb5': ['auth', 'access', 'chpass'],
>--
>1.8.3.1
>
>From 591d2a10b7d21c6381a0dfa4c92f2ef1949ad099 Mon Sep 17 00:00:00 2001
>From: Sumit Bose <sbose at redhat.com>
>Date: Fri, 28 Feb 2014 10:05:34 +0100
>Subject: [PATCH 2/2] SUDO: AD provider
>
>This patch adds the sudo target to the AD provider. The main reason is
>to cover different default settings in the LDAP and AD provider. E.g.
>the default for ldap_id_mapping is True in the AD provider and False
>in the LDAP provider. If ldap_id_mapping was not set explicitly in the
>config file both components worked with different setting.
>
>Fixes https://fedorahosted.org/sssd/ticket/2256
>---
> Makefile.am | 5 +++++
> src/config/SSSDConfigTest.py | 2 +-
> src/config/etc/sssd.api.d/sssd-ad.conf | 21 +++++++++++++++++++++
> src/man/sssd-ad.5.xml | 6 +++---
> src/man/sssd.conf.5.xml | 15 ++++++++++++---
> src/providers/ad/ad_common.h | 4 ++++
> src/providers/ad/ad_init.c | 25 +++++++++++++++++++++++++
> 7 files changed, 71 insertions(+), 7 deletions(-)
>
I think you forgot to include file src/providers/ad/ad_sudo.c
into this version.
LS
More information about the sssd-devel
mailing list