<html><head><meta http-equiv="Content-Type" content="text/plain;"><style> body { font-family: "Calibri","Slate Pro","sans-serif"; color:#262626 }</style> </head> <body data-blackberry-caret-color="#00a8df"><div>Evening, </div><div><br></div><div>After looking at almost all the SUDO documentation I could find, it looks one has to hardcode FreeIPA hostname on sssd.conf file. Below is what red hat advice to add in sssd config file.</div><div><span style="font-family: Calibri, 'Slate Pro', sans-serif;"><br></span></div><div><span style="font-family: Calibri, 'Slate Pro', sans-serif;">services = nss, pam, ssh, pac, sudo [domain/idm.coe.muc.redhat.com] sudo_provider = ldap ldap_uri = ldap://grobi.idm.coe.muc.redhat.com ldap_sudo_search_base = ou=sudoers,dc=idm,dc=coe,dc=muc,dc=redhat,dc=com ldap_sasl_mech = GSSAPI ldap_sasl_authid = host/tiffy.idm.coe.muc.redhat.com ldap_sasl_realm = IDM.COE.MUC.REDHAT.COM krb5_server = grobi.idm.coe.muc.redhat.com</span></div><div><span style="font-family: Calibri, 'Slate Pro', sans-serif;"><br></span></div><div><span style="font-family: Calibri, 'Slate Pro', sans-serif;">The implications of adding above is that SUDO would break if the hardcoded ipa is not available even if there is another replica somewhere in the network. Is that correct assumption? </span></div><div><span style="font-family: Calibri, 'Slate Pro', sans-serif;"><br></span></div><div><span style="font-family: Calibri, 'Slate Pro', sans-serif;">Is there a better way of doing it that I have missed?</span></div><div><span style="font-family: Calibri, 'Slate Pro', sans-serif;"><br></span></div><div><span style="font-family: Calibri, 'Slate Pro', sans-serif;">Thanks</span></div><div><span style="font-family: Calibri, 'Slate Pro', sans-serif;"><br></span></div><div><span style="font-family: Calibri, 'Slate Pro', sans-serif;">William</span></div><div><br></div><div></div></body></html>