#1505 sudo with sss backend should use ipa_hostname
Closed: Invalid None Opened 7 years ago by dpal.

https://bugzilla.redhat.com/show_bug.cgi?id=853540 (Fedora)

Description of problem:

The "ipa_hostname" option in sssd.conf can be used to override the
machine's hostname, which is useful when 3rd-party applications like
SAP require a short hostname instead of the FQDN.

When sudo is used with the sss backend, it checks the sudo rules from
the IPA server against the machine's hostname, not against the value
of the ipa_hostname parameter.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:

1. Add "sudoers: files sss" in /etc/nsswitch.conf

2. Add the following lines in /etc/sssd/sssd.conf:

   ipa_hostname = client01.example.com
   sudo_provider = ldap
   ldap_uri = ldap://idm01.example.com
   ldap_sudo_search_base = ou=SUDOers,dc=example,dc=com
   ldap_sasl_mech = GSSAPI
   ldap_sasl_authid = host/client01.example.com
   ldap_sasl_realm = EXAMPLE.COM
   krb5_server = idm01.example.com

   services = nss, pam, ssh, sudo


3. Run

   su - testuser
   sudo -l

Actual results:

If the sudo rule in IPA is restricted to client01.example.com,
"sudo -l" works as long as the hostname is left at its original value.

After running "hostname client01" and clearing the sssd cache,
"sudo -l" doesn't show the sudo rules anymore.

Expected results:

sudo should honor the ipa_hostname value when the sss backend is used.

As discussed in the associated bugzilla entry, this has been already implemented as part of the sudo redesign.

blockedby: =>
blocking: =>
coverity: =>
feature_milestone: =>
resolution: => worksforme
status: new => closed
tests: => 0
testsupdated: => 0
upgrade: => 0

Fields changed

milestone: NEEDS_TRIAGE => SSSD 1.9.0 RC1

Metadata Update from @dpal:
- Issue set to the milestone: SSSD 1.9.0 RC1

3 years ago

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/2547

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Login to comment on this ticket.