<div dir="ltr">I know I'm missing something simple. But I just can't get this ipa client to accept any sudo rules.<div><br></div><div><div>-sh-4.1$ sudo -l</div><div>[sudo] password for <a href="mailto:testadm@domain.com">testadm@domain.com</a>:<br>
</div><div>User <a href="mailto:testadm@domain.com">testadm@domain.com</a> is not allowed to run sudo on cypress.</div><div>-sh-4.1$ id</div><div>uid=11659(<a href="mailto:testadm@domain.com">testadm@domain.com</a>) gid=11659(<a href="mailto:testadm@domain.com">testadm@domain.com</a>) groups=11659(testadm@domain.</div>
<div>com),160400007(ad_klasadm) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023</div></div><div><br></div><div><div>-sh-4.1$ kinit admin</div><div>Password for <a href="mailto:admin@HOSTED.DOMAIN.COM">admin@HOSTED.DOMAIN.COM</a>:</div>
<div>-sh-4.1$ ipa sudorule-show operations</div><div> Rule name: operations<br></div><div> Description: KLAS / System Admins</div><div> Enabled: TRUE</div><div> Command category: all</div><div> Users: localadm</div><div>
User Groups: ad_operations, ad_operations_external, ad_klasadm,</div><div> ad_klasadm_external</div><div><br></div></div><div>/var/log/sssd/sssd_sudo.log</div><div><div>(Tue Apr 8 15:08:46 2014) [sssd[sudo]] [sudosrv_cmd_parse_query_done] (0x0200): Requesting rules for [testadm] from [<a href="http://DOMAIN.COM">DOMAIN.COM</a>]</div>
<div>(Tue Apr 8 15:08:46 2014) [sssd[sudo]] [sudosrv_get_user] (0x0200): Requestinginfo about [<a href="mailto:testadm@DOMAIN.COM">testadm@DOMAIN.COM</a>]</div><div>(Tue Apr 8 15:08:46 2014) [sssd[sudo]] [sudosrv_get_user] (0x0400): Returning info for user [<a href="mailto:testadm@DOMAIN.COM">testadm@DOMAIN.COM</a>]</div>
<div>(Tue Apr 8 15:08:46 2014) [sssd[sudo]] [sudosrv_get_rules] (0x0400): Retrieving rules for [<a href="mailto:testadm@DOMAIN.COM">testadm@DOMAIN.COM</a>] from [<a href="http://DOMAIN.COM">DOMAIN.COM</a>]</div><div>(Tue Apr 8 15:08:46 2014) [sssd[sudo]] [sysdb_search_group_by_gid] (0x0400): No such entry</div>
<div>(Tue Apr 8 15:08:46 2014) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(sudoUser=ALL)(name=defaults)(sudoUser=<a href="mailto:testadm@DOMAIN.COM">testadm@DOMAIN.COM</a>)(sudoUser=#11659)(sudoUser=%ad_klasadm)(sudoUser=+*))(&(dataExpireTimestamp<=1396984126)))]</div>
<div>(Tue Apr 8 15:08:46 2014) [sssd[sudo]] [sysdb_search_group_by_gid] (0x0400): No such entry</div><div>(Tue Apr 8 15:08:46 2014) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(sudoUser=ALL)(sudoUser=<a href="mailto:testadm@DOMAIN.COM">testadm@DOMAIN.COM</a>)(sudoUser=#11659)(sudoUser=%ad_klasadm)(sudoUser=+*)))]</div>
<div>(Tue Apr 8 15:08:46 2014) [sssd[sudo]] [sudosrv_get_sudorules_from_cache] (0x0400): Returning 1 rules for [<a href="mailto:testadm@DOMAIN.COM">testadm@DOMAIN.COM</a>]</div><div>(Tue Apr 8 15:08:46 2014) [sssd[sudo]] [client_recv] (0x0200): Client disconnected!</div>
</div><div><br></div><div><br></div><div><div>[root@cypress etc]# cat nsswitch.conf</div><div>#</div><div># /etc/nsswitch.conf</div><div>#</div><div># An example Name Service Switch config file. This file should be</div><div>
# sorted with the most-used services at the beginning.</div>
<div>#</div><div># The entry '[NOTFOUND=return]' means that the search for an</div><div># entry should stop if the search in the previous entry turned</div><div># up nothing. Note that if the search failed due to some other reason</div>
<div># (like no NIS server responding) then the search continues with the</div><div># next entry.</div><div>#</div><div># Valid entries include:</div><div>#</div><div># nisplus Use NIS+ (NIS version 3)</div>
<div># nis Use NIS (NIS version 2), also called YP</div><div># dns Use DNS (Domain Name Service)</div><div># files Use the local files</div><div>
# db Use the local database (.db) files</div><div># compat Use NIS on compat mode</div><div># hesiod Use Hesiod for user lookups</div><div># [NOTFOUND=return] Stop searching if not found so far</div>
<div>#</div><div><br></div><div># To use db, put the "db" in front of "files" for entries you want to be</div><div># looked up first in the databases</div><div>#</div><div># Example:</div><div>#passwd: db files nisplus nis</div>
<div>#shadow: db files nisplus nis</div><div>#group: db files nisplus nis</div><div><br></div><div>passwd: files sss</div><div>shadow: files sss</div><div>group: files sss</div><div>sudoers: files sss</div>
<div><br></div><div>#hosts: db files nisplus nis dns</div><div>hosts: files dns</div><div><br></div><div># Example - obey only what nisplus tells us...</div><div>#services: nisplus [NOTFOUND=return] files</div>
<div>#networks: nisplus [NOTFOUND=return] files</div><div>#protocols: nisplus [NOTFOUND=return] files</div><div>#rpc: nisplus [NOTFOUND=return] files</div><div>#ethers: nisplus [NOTFOUND=return] files</div>
<div>
#netmasks: nisplus [NOTFOUND=return] files</div><div><br></div><div>bootparams: nisplus [NOTFOUND=return] files</div><div><br></div><div>ethers: files</div><div>netmasks: files</div><div>networks: files</div><div>
protocols: files</div><div>rpc: files</div><div>services: files sss</div><div><br></div><div>netgroup: files sss</div><div><br></div><div>publickey: nisplus</div><div><br></div><div>automount: files</div><div>
aliases: files nisplus</div><div><br></div><div>[root@cypress etc]# cd sssd</div><div>[root@cypress sssd]# ls</div><div>sssd.conf sssd.conf.deleted <a href="http://sssd.conf.sv" target="_blank">sssd.conf.sv</a></div>
<div>[root@cypress sssd]# cat sssd.conf</div>
<div>[domain/<a href="http://hosted.domain.com" target="_blank">hosted.domain.com</a>]</div><div><br></div><div>cache_credentials = True</div><div>krb5_store_password_if_offline = True</div><div>ipa_domain = <a href="http://hosted.domain.com" target="_blank">hosted.domain.com</a></div>
<div>id_provider = ipa</div><div>auth_provider = ipa</div><div>access_provider = ipa</div><div>ipa_hostname = <a href="http://cypress.hosted.domain.com" target="_blank">cypress.hosted.domain.com</a></div><div>chpass_provider = ipa</div>
<div>
ipa_dyndns_update = True</div><div>ipa_server = _srv_, <a href="http://ipa.hosted.domain.com" target="_blank">ipa.hosted.domain.com</a></div><div>ldap_tls_cacert = /etc/ipa/ca.crt</div><div>debug_level=6</div><div><br></div>
<div>#</div><div>
# sudo integration</div><div>#</div><div>sudo_provider = ldap</div><div>ldap_uri = ldap://<a href="http://ipa.hosted.domain.com" target="_blank">ipa.hosted.domain.com</a></div><div>ldap_sudo_search_base = ou=sudoers,dc=hosted,dc=domain,dc=com</div>
<div>ldap_sasl_mech = GSSAPI</div><div>ldap_sasl_authid = host/<a href="http://cypress.hosted.domain.com" target="_blank">cypress.hosted.domain.com</a></div><div>ldap_sasl_realm = <a href="http://HOSTED.DOMAIN.COM" target="_blank">HOSTED.DOMAIN.COM</a></div>
<div>krb5_server = <a href="http://ipa.hosted.domain.com" target="_blank">ipa.hosted.domain.com</a></div><div><br></div><div><br></div><div>[sssd]</div><div>services = nss, pam, ssh, pac, sudo</div><div>config_file_version = 2</div>
<div>
domains = <a href="http://hosted.domain.com" target="_blank">hosted.domain.com</a></div><div>debug_level=6</div><div><br></div><div>[nss]</div><div><br></div><div><br></div><div>[pam]</div><div><br></div><div><br></div><div>
[sudo]</div><div>
debug_level=6</div><div><br></div><div>[autofs]</div><div><br></div><div>[ssh]</div><div><br></div><div><br></div><div>[pac]</div><div><br></div><div>[root@cypress sssd]#</div></div><div><br></div></div>