<div dir="ltr"><div><div>Hi,<br></div> I had same issue after upgrading registered Centos 6.5 to 6.6 (and with new IPA client). New version already contain sudo support, so sssd.conf doesn't contain it. You can uninstall ipa client and register server again - keep configuration file generated by IPA client itself (I used puppet for maintain this file and end up with multiple version chaos because of centos and IPA versions)<br><br><br></div>Vasek<br><div><div><br></div><div>example of clean config file (you don't need to setup anything manually):<br><br>[domain/<a href="http://xxx.com" target="_blank">xxx.com</a>]<br><br>cache_credentials = True<br>krb5_store_password_if_offline = True<br>ipa_domain = <a href="http://xxx.com" target="_blank">xxx.com</a><br>id_provider = ipa<br>auth_provider = ipa<br>access_provider = ipa<br>ldap_tls_cacert = /etc/ipa/ca.crt<br>ipa_hostname = <a href="http://server.xxx.com" target="_blank">server.xxx.com</a><br>chpass_provider = ipa<br>ipa_server = _srv_, <a href="http://ipa.xxx.com" target="_blank">ipa.xxx.com</a><br>dns_discovery_domain = <a href="http://xxx.com" target="_blank">xxx.com</a><br><br>[sssd]<br>services = nss, sudo, pam, ssh<br>config_file_version = 2<br><br>domains = <a href="http://xxx.com" target="_blank">xxx.com</a><br>[nss]<br>homedir_substring = /home<br><br>[pam]<br><br>[sudo]<br><br>[autofs]<br><br>[ssh]<br><br>[pac]<br><br>[ifp]<br><br></div><div><br><br><br></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Sat, Jan 3, 2015 at 8:10 PM, Dmitri Pal <span dir="ltr"><<a href="mailto:dpal@redhat.com" target="_blank">dpal@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
<div>On 01/03/2015 05:14 AM, alireza baghery
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr"><br>
<div class="gmail_quote"><br>
<div dir="ltr">
<div>
<div>
<div>
<div>hi<br>
i integrated AD windows 208 R2 with IPA server
(centos 6.5)<br>
</div>
i write policy for user test execute any command on
any host<br>
</div>
user test can execute sudo on cetnos 6.5 but on centos
6.6 can not (sudo get error)<br>
</div>
confige sssd.conf<br>
=========================<br>
<pre>[domain/<a href="http://l.example.com" target="_blank">l.example.com</a>]
debug_level = 6
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = <a href="http://l.example.com" target="_blank">l.example.com</a>
id_provider = ipa
ipa_server = _srv_,<a href="http://ipaserver.l.example.com" target="_blank">ipaserver.l.example.com</a>
dap_tls_cacert = /etc/ipa/ca.crt
sudo_provider = ldap
ldap_uri = <a rel="nofollow">ldap://ipasrv.l.example.com</a>
ldap_sudo_search_base = ou=sudoers,dc=l, dc=example,dc=com
ldap_sasl_mech = GSSAPI
ldap_sasl_authid = host/<a href="http://ipadevel.l.example.com" target="_blank">ipadevel.l.example.com</a>
ldap_sasl_realm = <a href="http://L.EXAMPLE.COM" target="_blank">L.EXAMPLE.COM</a>
krb5_server = <a href="http://ipadevel.l.example.com" target="_blank">ipadevel.l.example.com</a>
[sssd]
config_file_version = 2
services = nss, pam,ssh,sudo
</pre>
============================<br>
</div>
how to solve this problem<br>
</div>
</div>
<br>
</div>
<br>
<fieldset></fieldset>
<br>
</blockquote>
Enable sudo debugging and see what happens. Is the command denied or
there is some other error?<br>
Generally there are two flavors of errors: something is wrong with a
connection and no policy gets through or the policies get though but
something is wrong with this specific policy or configuration.<br>
To start debugging first rule out connectivity issues.<br>
<br>
SUDO and sssd debug logs are your friends.<span class="HOEnZb"><font color="#888888"><br>
<br>
<pre cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
</font></span></div>
<br>--<br>
Manage your subscription for the Freeipa-users mailing list:<br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
Go To <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project<br></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature">-- May the fox be with you ...<br> /\<br> (~(<br> ) ) /\_/\<br> (_=---_(@ @)<br> ( \ / <br> /|/----\|\ V<br> " " " "<br><br><br></div>
</div>