Learn more about these different git repos.
Other Git URLs
Description of problem:
The "ipa_hostname" option in sssd.conf can be used to override the
machine's hostname, which is useful when 3rd-party applications like
SAP require a short hostname instead of the FQDN.
When sudo is used with the sss backend, it checks the sudo rules from
the IPA server against the machine's hostname, not against the value
of the ipa_hostname parameter.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Add "sudoers: files sss" in /etc/nsswitch.conf
2. Add the following lines in /etc/sssd/sssd.conf:
ipa_hostname = client01.example.com
sudo_provider = ldap
ldap_uri = ldap://idm01.example.com
ldap_sudo_search_base = ou=SUDOers,dc=example,dc=com
ldap_sasl_mech = GSSAPI
ldap_sasl_authid = host/client01.example.com
ldap_sasl_realm = EXAMPLE.COM
krb5_server = idm01.example.com
services = nss, pam, ssh, sudo
su - testuser
If the sudo rule in IPA is restricted to client01.example.com,
"sudo -l" works as long as the hostname is left at its original value.
After running "hostname client01" and clearing the sssd cache,
"sudo -l" doesn't show the sudo rules anymore.
sudo should honor the ipa_hostname value when the sss backend is used.
As discussed in the associated bugzilla entry, this has been already implemented as part of the sudo redesign.
resolution: => worksforme
status: new => closed
tests: => 0
testsupdated: => 0
upgrade: => 0
milestone: NEEDS_TRIAGE => SSSD 1.9.0 RC1
Metadata Update from @dpal:
- Issue set to the milestone: SSSD 1.9.0 RC1
to comment on this ticket.