<div dir="ltr"><div>Hi Pavel,</div><div><br></div><div>sdainard-admin is a Windows domain user, part of an external group 'ad_admins_external' which is a member of 'ad_admins', an ipa posix group.</div><div>
<br></div><div>'admins' groups is the built-in ipa admin group.</div><div><br></div><div>ipa group-show admins</div><div> Group name: admins</div><div> Description: Account administrators group</div><div> GID: 1768200000</div>
<div> Member users: admin</div><div> Member groups: ad_admins</div><div> Member of Sudo rule: ad_admins</div><div> Indirect Member groups: ad_admins_external</div><div><br></div><div><div>ipa group-show ad_admins</div>
<div> Group name: ad_admins</div><div> Description: miovision.corp admins</div><div> GID: 1768200004</div><div> Member users: admin</div><div> Member groups: ad_admins_external</div><div> Member of groups: admins</div>
<div> Member of Sudo rule: ad_admins, All</div></div><div><br></div><div>Thanks,</div></div><div class="gmail_extra"><br clear="all"><div><div dir="ltr"><span style="font-family:arial,sans-serif;font-size:16px"><strong>Steve Dainard </strong></span><span style="font-size:12px"></span><br>
<span style="font-family:arial,sans-serif;font-size:12px">IT Infrastructure Manager<br>
<a href="http://miovision.com/" target="_blank">Miovision</a> | <em>Rethink Traffic</em><br><br>
<strong style="font-family:arial,sans-serif;font-size:13px;color:#999999"><a href="http://miovision.com/blog" target="_blank">Blog</a> | </strong><font color="#999999" style="font-family:arial,sans-serif;font-size:13px"><strong><a href="https://www.linkedin.com/company/miovision-technologies" target="_blank">LinkedIn</a> | <a href="https://twitter.com/miovision" target="_blank">Twitter</a> | <a href="https://www.facebook.com/miovision" target="_blank">Facebook</a></strong></font> </span>
<hr style="font-family:arial,sans-serif;font-size:13px;color:#333333;clear:both">
<div style="color:#999999;font-family:arial,sans-serif;font-size:13px;padding-top:5px">
<span style="font-family:arial,sans-serif;font-size:12px">Miovision Technologies Inc. | 148 Manitou Drive, Suite 101, Kitchener, ON, Canada | N2C 1L3</span><br>
<span style="font-family:arial,sans-serif;font-size:12px">This e-mail may contain information that is privileged or confidential. If you are not the intended recipient, please delete the e-mail and any attachments and notify us immediately.</span></div>
</div></div>
<br><br><div class="gmail_quote">On Wed, Feb 19, 2014 at 8:48 AM, Pavel Březina <span dir="ltr"><<a href="mailto:pbrezina@redhat.com" target="_blank">pbrezina@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="HOEnZb"><div class="h5">On 02/18/2014 10:32 PM, Steve Dainard wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
Hi Pavel,<br>
<br>
Very interesting, my IPA group membership in ad_admins isn't shown by<br>
that command on first run (new login)<br>
<br>
sdainard-admin@miovision.corp@<u></u>ubu1310:~$ id sdainard-admin<br>
uid=799002462(sdainard-admin@<u></u>miovision.corp)<br>
gid=799002462(sdainard-admin@<u></u>miovision.corp)<br>
groups=799002462(sdainard-<u></u>admin@miovision.corp),<u></u>799001380(accounting-share-<u></u>access@miovision.corp),<u></u>799001417(protected-share-<u></u>access@miovision.corp),<u></u>799000519(enterprise<br>
admins@miovision.corp),<u></u>799001416(hr-share-access@<u></u>miovision.corp),799000512(<u></u>domain<br>
admins@miovision.corp),<u></u>799000513(domain<br>
users@miovision.corp),<u></u>799002464(it -<br>
admins@miovision.corp),<u></u>799002469(kloperators@<u></u>miovision.corp),799002468(<u></u>kladmins@miovision.corp)<br>
<br>
sdainard-admin@miovision.corp@<u></u>ubu1310:~$ sudo su<br>
[sudo] password for sdainard-admin@miovision.corp:<br>
sdainard-admin@miovision.corp is not allowed to run sudo on ubu1310.<br>
This incident will be reported.<br>
<br>
But after attempting the sudo command my groups do contain the IPA<br>
groups admins,ad_admins:<br>
<br>
sdainard-admin@miovision.corp@<u></u>ubu1310:~$ id sdainard-admin<br>
uid=799002462(sdainard-admin@<u></u>miovision.corp)<br>
gid=799002462(sdainard-admin@<u></u>miovision.corp)<br>
groups=799002462(sdainard-<u></u>admin@miovision.corp),<u></u>799001380(accounting-share-<u></u>access@miovision.corp),<u></u>799001417(protected-share-<u></u>access@miovision.corp),<u></u>799000519(enterprise<br>
admins@miovision.corp),<u></u>799001416(hr-share-access@<u></u>miovision.corp),799000512(<u></u>domain<br>
admins@miovision.corp),<u></u>799000513(domain<br>
users@miovision.corp),<u></u>799002464(it -<br></div></div>
admins@miovision.corp),<u></u>799002469(kloperators@<u></u>miovision.corp),799002468(<u></u>kladmins@miovision.corp),*<u></u>1768200000(admins),1768200004(<u></u>ad_admins)*<div class=""><br>
<br>
sdainard-admin@miovision.corp@<u></u>ubu1310:~$ sudo su<br>
[sudo] password for sdainard-admin@miovision.corp:<br>
root@ubu1310:/home/miovision.<u></u>corp/sdainard-admin#<br>
<br>
<br>
Sudo rule (I had to create this, apparently its a default rule, but<br>
didn't exist in my install on RHEL7 beta):<br>
Rule name: All<br>
Enabled: TRUE<br>
Host category: all<br>
Command category: all<br>
RunAs User category: all<br>
RunAs Group category: all<br>
User Groups: ad_admins<br>
</div></blockquote>
<br>
Can you tell me more information about admins and ad_admins groups and sdainard-admin? I would like to know how the membership is configured and what is their relation to AD. Dump of ipa user-show and ipa group-show should be enough, I think.<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="">
<br>
I saw the new dns update option (and refresh timers!), thanks.<br>
<br></div><div class="">
*Steve Dainard *<br>
IT Infrastructure Manager<br>
Miovision <<a href="http://miovision.com/" target="_blank">http://miovision.com/</a>> | /Rethink Traffic/<br>
<br>
*Blog <<a href="http://miovision.com/blog" target="_blank">http://miovision.com/blog</a>> | **LinkedIn<br>
<<a href="https://www.linkedin.com/company/miovision-technologies" target="_blank">https://www.linkedin.com/<u></u>company/miovision-technologies</a><u></u>> | Twitter<br>
<<a href="https://twitter.com/miovision" target="_blank">https://twitter.com/miovision</a><u></u>> | Facebook<br>
<<a href="https://www.facebook.com/miovision" target="_blank">https://www.facebook.com/<u></u>miovision</a>>*<br>
------------------------------<u></u>------------------------------<u></u>------------<br></div><div class="">
Miovision Technologies Inc. | 148 Manitou Drive, Suite 101, Kitchener,<br>
ON, Canada | N2C 1L3<br>
This e-mail may contain information that is privileged or confidential.<br>
If you are not the intended recipient, please delete the e-mail and any<br>
attachments and notify us immediately.<br>
<br>
<br>
On Tue, Feb 18, 2014 at 5:27 AM, Pavel Březina <<a href="mailto:pbrezina@redhat.com" target="_blank">pbrezina@redhat.com</a><br></div><div class="">
<mailto:<a href="mailto:pbrezina@redhat.com" target="_blank">pbrezina@redhat.com</a>>> wrote:<br>
<br>
On 02/17/2014 10:29 PM, Steve Dainard wrote:<br>
<br>
I can't reproduce consistently on any OS including Fedora 20,<br>
but I was<br>
able to trigger the issue on a Ubuntu 13.10 client.<br>
<br>
sssd: 1.11.1<br>
<br>
sudo: 1.8.6p3-0ubuntu3<br>
<br>
I have only just enabled the sudo logging so it should only<br>
contain the<br>
events below:<br>
<br></div>
sdainard-admin@miovision.corp@<u></u>__ubu1310:~$ sudo su<div class=""><br>
[sudo] password for sdainard-admin@miovision.corp:<br>
sdainard-admin@miovision.corp is not allowed to run sudo on ubu1310.<br>
This incident will be reported.<br></div>
sdainard-admin@miovision.corp@<u></u>__ubu1310:~$ sudo su<br>
[sudo] password for sdainard-admin@miovision.corp:<br>
root@ubu1310:/home/miovision._<u></u>_corp/sdainard-admin#<div class=""><br>
<br>
Files attached outside of list.<br>
<br>
<br>
Hi,<br>
thank you for the logs. Can you also send me output of command "id<br>
sdainard-admin" (also check if group membership is correct) and<br>
definition of the sudo rule please?<br>
<br>
Also you may want to fix the following (unrelated) warning:<br>
Deprecation warning: The option ipa_dyndns_update is deprecated and<br>
should not be used in favor of dyndns_update<br>
<br>
<br>
</div></blockquote>
<br>
</blockquote></div><br></div>