Simo,<br><br>What surprised me was that it also works for sudo rules that are delivered via LDAP.<br>We don't have a local sudoers file, but all sudo rules are in LDAP. <br><br>Which means, that when a users logs in on the system, the sudo rules for that user must be cached also by SSSD. <br>
<br><br>cheers,<br>Andy<br><br><div class="gmail_quote">2011/4/29 Simo Sorce <span dir="ltr"><<a href="mailto:ssorce@redhat.com">ssorce@redhat.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div><div></div><div class="h5">On Fri, 2011-04-29 at 09:47 +0200, Andy Kannberg wrote:<br>
> Hi all,<br>
><br>
> Currently, we run SSSD on a RHEL5 update 4 box. SSSD version is 1.2.1.<br>
> For the main purpose we need it, caching credentials, it works like a<br>
> charm.<br>
> Now, we have a custom compiled sudo version (sudo 1.6) which does<br>
> query LDAP for the sudo rules.<br>
><br>
> I was testing if sudo still worked while using cached credentials.<br>
> (Which is one of the requirements of the project, as users are not<br>
> allowed root access)<br>
> and it did work. I simply pulled the network cable out of the network<br>
> interface, rebooted the machine, logged in with cached credentials and<br>
> tried a sudo su - (Which I am allowed to do). And it worked. Is this<br>
> intended behaviour, am I looking at the wrong things or did I discover<br>
> a 'hidden feature/anomaly'due to the custom sudo version ?<br>
><br>
> I tried searching on sudo and sssd with google, I only read articles<br>
> that sudo and sssd are not integrated yet(but in the works), so I am<br>
> wondering how this works.<br>
<br>
</div></div>Andy,<br>
sssd will allow authentication through PAM for any process, sudo<br>
included, and, if offline, it will allow authentication through offlined<br>
credentials.<br>
<br>
If you have NOPASSWD set in your sudo configuration for the su - command<br>
it won't ask you a password nor talk with any other component of the<br>
box.<br>
If you don't have NOPASSWD then it will ask for your normal user<br>
password and go through the PAM stack to sssd_pam, which may allow you<br>
to authenticate through offline credentials, if offline, or by doing a<br>
normal online password check.<br>
<br>
What is it that surprised you ? It looks like normal behavior to me<br>
(from the sssd pov).<br>
<br>
Simo.<br>
<font color="#888888"><br>
--<br>
Simo Sorce * Red Hat, Inc * New York<br>
<br>
_______________________________________________<br>
sssd-devel mailing list<br>
<a href="mailto:sssd-devel@lists.fedorahosted.org">sssd-devel@lists.fedorahosted.org</a><br>
<a href="https://fedorahosted.org/mailman/listinfo/sssd-devel" target="_blank">https://fedorahosted.org/mailman/listinfo/sssd-devel</a><br>
</font></blockquote></div><br>