Re: Solaris 10, AD authentication and sudo (excessive) AD group lookups

Todd,
That seems to have done the trick. Sudo sees all 166 AD groups. Appreciate the quick response.

_Jeff


-----Original Message-----
From: Todd C. Miller [mailto:[email protected]] 
Sent: Thursday, June 14, 2018 6:07 AM
To: Jeff Martin <[email protected]>
Cc: [email protected]
Subject: Re: [sudo-users] Solaris 10, AD authentication and sudo (excessive) AD group lookups

On Wed, 13 Jun 2018 17:18:24 -0000, Jeff Martin wrote:

> User belonging to many > 150 AD Groups, may not allow sudo to see the 
> group s o lookup of %GROUP in sudoers fails with permission not 
> allowed if group not in first 32 lookups.
>
> Solaris 10 SPARC
> Sudo 1.8.23
> Compiled on system default options
> Powerbroker Open AD authentication
>
> User belongs to 166 AD groups.
> Powerbroker sees 166 AD group memberships.
> Sudo sees 32 groups based on turning on sudo debug mode and checking 
> the logs  for # occurrences of "user is a member of ...."

Please try adding the following lines to your sudo.conf file:

Set group_source dynamic
Set max_groups 256

Sudo will query the nsswitch group provider for the user's groups, but I don't know whether Powerbroker will exposes all groups or just up to the system maximum.

 - todd
____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users