<div dir="ltr"><div><div>Cory,<br><br></div>Thanks for the update and link. And a big thanks to everyone else for their time looking at this. I also was able to install the referenced .deb and now sudo works as expected.<br><br></div>Jeff<br><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Aug 30, 2016 at 12:46 PM, Cory Francis Myers <span dir="ltr"><<a href="mailto:cory@trinitymobilenetworks.com" target="_blank">cory@trinitymobilenetworks.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Pavel Březina | Tue, 30 Aug 2016 02:59:55 -0700:<br>
> unfortunately sudo 1.8.16 introduced a bug in sssd plugin. 1.8.16<br>
> contains a new option called netgroup_tuple, which tells whether a<br>
> full netgroup tuply is check or only the host/user part in host/user<br>
> check. However, the patch didn't make the sssd plugin to obey this<br>
> option and it always check both hostname and username.<br>
><br>
> It is fixed in 1.8.17 by this patch:<br>
> <a href="https://www.sudo.ws/repos/sudo/rev/2eab4070dcf7" rel="noreferrer" target="_blank">https://www.sudo.ws/repos/<wbr>sudo/rev/2eab4070dcf7</a><br>
><br>
> Please, report bug against Ubuntu sudo to backport this patch or rebase<br>
> sudo.<br>
<br>
Already open on Launchpad, it looks like:<br>
<br>
<a href="https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/1607666" rel="noreferrer" target="_blank">https://bugs.launchpad.net/<wbr>ubuntu/+source/sudo/+bug/<wbr>1607666</a><br>
<br>
<br>
sudo 1.8.17 installed from "sudo_1.8.17-2_amd64.deb"[1] is working for<br>
us now. Thank you for the suggestion.<br>
<br>
Jeff, I hope you have the same good luck.<br>
<br>
<br>
--- cfm.<br>
<br>
<br>
[1] <a href="https://www.sudo.ws/download.html" rel="noreferrer" target="_blank">https://www.sudo.ws/download.<wbr>html</a><br>
<br>--<br>
Manage your subscription for the Freeipa-users mailing list:<br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/<wbr>mailman/listinfo/freeipa-users</a><br>
Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project<br></blockquote></div><br><br clear="all"><br><br></div></div>