Learn more about these different git repos.
Other Git URLs
Description of problem:
The "ipa_hostname" option in sssd.conf can be used to override the
machine's hostname, which is useful when 3rd-party applications like
SAP require a short hostname instead of the FQDN.
When sudo is used with the sss backend, it checks the sudo rules from
the IPA server against the machine's hostname, not against the value
of the ipa_hostname parameter.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Add "sudoers: files sss" in /etc/nsswitch.conf
2. Add the following lines in /etc/sssd/sssd.conf:
ipa_hostname = client01.example.com
sudo_provider = ldap
ldap_uri = ldap://idm01.example.com
ldap_sudo_search_base = ou=SUDOers,dc=example,dc=com
ldap_sasl_mech = GSSAPI
ldap_sasl_authid = host/client01.example.com
ldap_sasl_realm = EXAMPLE.COM
krb5_server = idm01.example.com
services = nss, pam, ssh, sudo
su - testuser
If the sudo rule in IPA is restricted to client01.example.com,
"sudo -l" works as long as the hostname is left at its original value.
After running "hostname client01" and clearing the sssd cache,
"sudo -l" doesn't show the sudo rules anymore.
sudo should honor the ipa_hostname value when the sss backend is used.
As discussed in the associated bugzilla entry, this has been already implemented as part of the sudo redesign.
resolution: => worksforme
status: new => closed
tests: => 0
testsupdated: => 0
upgrade: => 0
milestone: NEEDS_TRIAGE => SSSD 1.9.0 RC1
Metadata Update from @dpal:
- Issue set to the milestone: SSSD 1.9.0 RC1
SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.
This issue has been cloned to Github and is available here:
If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.
Thank you for understanding. We apologize for all inconvenience.
to comment on this ticket.