Re: Problem with matching group names with domain in sudoers

On Fri, 31 Mar 2017 06:43:45 -0400, Tomas Sykora wrote:

> The group is defined on an ipa server, it should be found through sssd.
> So how should I define this rule in sudoers, if I want it to match the 
> ipa server group and allow user to run sudo? I thought that %group@domain 
> is the right definition.

The problem is that sudo doesn't know what is an ipa group and what
is a local group.  It just uses the standard group lookup functions.

I suppose sudo could have an option to determine the IPA domain(s)
by parsing /etc/sssd/sssd.conf but it still doesn't have a way of
looking up a group by domain.  If you want this to be supported,
the proper way is to have a sudoers group plugin that talks to sssd
directly.

 - todd
____________________________________________________________
sudo-workers mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-workers