<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;"><div>For the NOPASSWD option, I found that using <span style="font-family: 'liberation mono', 'bitstream vera mono', 'dejavu mono', monospace; font-size: 0.9em; line-height: 1.29em; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(245, 245, 245);">!authenticate</span> in the sudo option is what IPA wants instead.</div><div><br></div><div><pre class="screen" style="widows: 2; orphans: 2; line-height: 1.29em; font-family: 'liberation mono', 'bitstream vera mono', 'dejavu mono', monospace; border: 1px solid rgb(170, 170, 170); margin-bottom: 0.3em; padding: 0.5em 1em; white-space: pre-wrap; word-wrap: break-word; font-size: 0.9em; border-top-left-radius: 11px; border-top-right-radius: 11px; border-bottom-right-radius: 11px; border-bottom-left-radius: 11px; page-break-inside: avoid; background-color: rgb(245, 245, 245);">$ ipa sudorule-add-option readfiles
Sudo Option: !authenticate
-----------------------------------------------------
Added option "!authenticate" to Sudo rule "readfiles"
-----------------------------------------------------</pre></div><div><br></div><span id="OLK_SRC_BODY_SECTION"><div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt"><span style="font-weight:bold">From: </span> Dmitri Pal <<a href="mailto:dpal@redhat.com">dpal@redhat.com</a>><br><span style="font-weight:bold">Organization: </span> Red Hat<br><span style="font-weight:bold">Reply-To: </span> "<a href="mailto:dpal@redhat.com">dpal@redhat.com</a>" <<a href="mailto:dpal@redhat.com">dpal@redhat.com</a>><br><span style="font-weight:bold">Date: </span> Tuesday, May 12, 2015 at 5:32 PM<br><span style="font-weight:bold">To: </span> "<a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>" <<a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>><br><span style="font-weight:bold">Subject: </span> Re: [Freeipa-users] Allow user or group to switch user without password and not becoming root<br></div><div><br></div><div><div text="#000000" bgcolor="#FFFFFF"><div class="moz-cite-prefix">On 05/12/2015 04:44 PM, Andrey Ptashnik wrote:<br></div><blockquote cite="mid:812E1DF1-22C5-49F2-9AB4-9E2E765E1977@cccis.com" type="cite"><div>Hello Team,</div><div><br></div><div>We have RHEL 7.1 and IPA server 4.1.0 in our environment as well as stack of Oracle software that require existence of local passwordless users like weblogic and oracle. </div><div>Users log in to servers via domain accounts at IPA server.</div><div><br></div><div>I’m trying to configure Sudo policy in IPA server that will allow users in the company to log in to servers in IPA domain and switch to weblogic or oracle user without having to enter any passwords, but also without increasing their privileges to root.</div><div>Using plain /etc/sudoers file it can be accomplished something like below:</div><div><br></div><div>%users ALL = (root) </div></blockquote><br>
Users will be who of the IPA sudo rule<br><br><blockquote cite="mid:812E1DF1-22C5-49F2-9AB4-9E2E765E1977@cccis.com" type="cite"><div>NOPASSWD:</div></blockquote><br>
This will be an option that you would put into the sudo rule<br><br><blockquote cite="mid:812E1DF1-22C5-49F2-9AB4-9E2E765E1977@cccis.com" type="cite"><div>/bin/su – oracle <br></div></blockquote><br>
This will be the command. You create a command and then reference it in the rule.<br><br>
At least this is what I would try.<br><br><blockquote cite="mid:812E1DF1-22C5-49F2-9AB4-9E2E765E1977@cccis.com" type="cite"><div><br></div><div>How can I configure this behavior in IPA server?</div><div><br></div><div><div id=""><div>Regards,</div><div><br></div><div>Andrey</div><div><br></div></div></div><br><fieldset class="mimeAttachmentHeader"></fieldset> <br></blockquote><br><br><pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Director of Engineering for IdM portfolio
Red Hat, Inc.</pre></div></div></span></body></html>