<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span>Hi Jakub and Rich,</span></div><div><span><br></span></div><div><span>Got it.</span></div><div><span><br></span></div><div><span>Thanks a lot on the HBAC and sudoes maps access. I think I got confused with the graph in the powerpoint presentation http://www.redhat.com/summit/2011/presentations/summit/whats_next/friday/pal_crittenden_f_1100_ipa_overview_rev3.pdf. The graph 'Under the hood' claimed that user/group/netgroup/HBAC will go through sssd, while other maps (sudo, autofs?) would goes through nss_ldap.</span></div><div><span><br></span></div><div><span> So it could be that FreeIPA has been further developed to provide DIRECTLY more mappings without the help of pam_(ldap/kerberos) and nss_ldap? To Rich, could you confirm that -- and probably more mappings -- in this version 2.1.3-9 on red hat 6.2?
If not, how about 2.2 on Redhat 6.3Beta? Thanks a lot.</span></div><div><span><br></span></div><div> Have a nice weekend.</div><div><br></div><div>--Gelen</div><div><span><br></span></div><div><span><br></span></div><div><span><br></span></div><div><br></div> <div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "> <div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "> <div dir="ltr"> <font size="2" face="Arial"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Jakub Hrozek <jhrozek@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> Gelen James <hahaha_30k@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> "freeipa-users@redhat.com" <freeipa-users@redhat.com> <br> <b><span style="font-weight: bold;">Sent:</span></b> Saturday, May 19, 2012 10:16 AM<br> <b><span style="font-weight: bold;">Subject:</span></b>
Re: [Freeipa-users] sudo rules in IPA infrastructure<br> </font> </div> <br>
On Fri, May 18, 2012 at 02:35:18PM -0700, Gelen James wrote:<br>> Hi all,<br>> Are the sudo rules applied to IPA clients through nss_ldap, instead of<br>> sssd? <br><br>Neither :-)<br><br>sudo looks up the user information via the standard name-service-switch<br>maps, so if your machine is configured to fetch user and group<br>information using the sss NSS module in nsswitch.conf, then the requests<br>get to sssd.<br><br>As Stephen Ingram pointed out elsewhere in this thread, sudo only reads<br>the nss_ldap/nss-pam-ldapd config files but establishes the connection<br>to the LDAP server and fetches the data on its own.<br><br>_______________________________________________<br>Freeipa-users mailing list<br><a ymailto="mailto:Freeipa-users@redhat.com" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br><a href="https://www.redhat.com/mailman/listinfo/freeipa-users"
target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br><br><br> </div> </div> </div></body></html>