Description of problem:

The "ipa_hostname" option in sssd.conf can be used to override the
machine's hostname, which is useful when 3rd-party applications like
SAP require a short hostname instead of the FQDN.

When sudo is used with the sss backend, it checks the sudo rules from
the IPA server against the machine's hostname, not against the value
of the ipa_hostname parameter.


Version-Release number of selected component (if applicable):

sssd-1.8.4-14.fc17.x86_64
sudo-1.8.3p1-7.fc17.x86_64


How reproducible:

always


Steps to Reproduce:

1. Add "sudoers: files sss" in /etc/nsswitch.conf

2. Add the following lines in /etc/sssd/sssd.conf:

   [domain/example.com]
   ...
   ipa_hostname = client01.example.com
   sudo_provider = ldap
   ldap_uri = ldap://idm01.example.com
   ldap_sudo_search_base = ou=SUDOers,dc=example,dc=com
   ldap_sasl_mech = GSSAPI
   ldap_sasl_authid = host/client01.example.com
   ldap_sasl_realm = EXAMPLE.COM
   krb5_server = idm01.example.com

   [sssd]
   services = nss, pam, ssh, sudo
   ...

   [sudo]

3. Run

   su - testuser
   sudo -l


Actual results:

If the sudo rule in IPA is restricted to client01.example.com,
"sudo -l" works as long as the hostname is left at its original value.

After running "hostname client01" and clearing the sssd cache,
"sudo -l" doesn't show the sudo rules anymore.


Expected results:

sudo should honor the ipa_hostname value when the sss backend is used.