<div>I have a working IPA server and a working client config on an OpenSuse 13.2 with the following versions:</div>
<div> </div>
<div>
<div>nappali:~ # rpm -qa |grep sssd<br />
sssd-tools-1.12.2-3.4.1.i586<br />
sssd-krb5-1.12.2-3.4.1.i586<br />
python-sssd-config-1.12.2-3.4.1.i586<br />
sssd-ipa-1.12.2-3.4.1.i586<br />
sssd-1.12.2-3.4.1.i586<br />
sssd-dbus-1.12.2-3.4.1.i586<br />
sssd-krb5-common-1.12.2-3.4.1.i586<br />
sssd-ldap-1.12.2-3.4.1.i586</div>
<div> </div>
<div>sssd is confihured for nss, pam, sudo</div>
<div> </div>
<div>There is a test sudo rule defined in the ipa server, which applies to user "doma". However when the user tries to use sudo the rule does not work.</div>
<div> </div>
<div>
<div>doma@nappali:/home/doma> sudo ls<br />
doma's password:<br />
doma is not allowed to run sudo on nappali. This incident will be reported.</div>
<div> </div>
The corresponding log in the sssd_sudo.log is this:
<div> </div>
<div>
<div>(Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sss_cmd_get_version] (0x0200): Received client version [1].<br />
(Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sss_cmd_get_version] (0x0200): Offered version [1].<br />
(Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): name 'doma' matched without domain, user is doma<br />
(Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): name 'doma' matched without domain, user is doma<br />
(Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sudosrv_cmd_parse_query_done] (0x0200): Requesting default options for [doma] from [<ALL>]<br />
(Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sudosrv_get_user] (0x0200): Requesting info about [doma@szilva]<br />
(Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(sudoUser=ALL)(name=defaults)(sudoUser=doma)(sudoUser=#1816400003)(sudoUser=%ipausers)(sudoUser=%picture_access)(sudoUser=%doma)(sudoUser=+*))(&(dataExpireTimestamp<=1441826725)))]<br />
(Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(name=defaults)))]<br />
(Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): name 'doma' matched without domain, user is doma<br />
(Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): name 'doma' matched without domain, user is doma<br />
(Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sudosrv_cmd_parse_query_done] (0x0200): Requesting rules for [doma] from [<ALL>]<br />
(Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sudosrv_get_user] (0x0200): Requesting info about [doma@szilva]<br />
(Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(sudoUser=ALL)(name=defaults)(sudoUser=doma)(sudoUser=#1816400003)(sudoUser=%ipausers)(sudoUser=%picture_access)(sudoUser=%doma)(sudoUser=+*))(&(dataExpireTimestamp<=1441826725)))]<br />
(Wed Sep 9 21:25:25 2015) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(sudoUser=ALL)(sudoUser=doma)(sudoUser=#1816400003)(sudoUser=%ipausers)(sudoUser=%picture_access)(sudoUser=%doma)(sudoUser=+*)))]<br />
(Wed Sep 9 21:25:30 2015) [sssd[sudo]] [client_recv] (0x0200): Client disconnected!</div>
<div> </div>
<div>This seems perfectly OK with one exception. The query against the sysdb does not find the entry. This is strange because the entry is there.</div>
<div>
<div> </div>
<div>Log in sssd.log:</div>
<div>
<div>(Wed Sep 2 08:52:13 2015) [sssd] [sysdb_domain_init_internal] (0x0200): DB File for szilva: /var/lib/sss/db/cache_szilva.ldb</div>
<div> </div>
</div>
<div>So we know that the sysdb is /var/lib/sss/db/cache_szilva.ldb</div>
<div> </div>
<div>Running the exact same query seen above in the sssd_sudo.log against the db returns:</div>
<div> </div>
</div>
<div>
<div>ldbsearch -H /var/lib/sss/db/cache_szilva.ldb "(&(objectClass=sudoRule)(|(sudoUser=ALL)(sudoUser=doma)(sudoUser=#1816400003)(sudoUser=%ipausers)(sudoUser=%picture_access)(sudoUser=%doma)(sudoUser=+*)))"<br />
asq: Unable to register control with rootdse!<br />
# record 1<br />
dn: name=Doma_ls,cn=sudorules,cn=custom,cn=szilva,cn=sysdb<br />
cn: Doma_ls<br />
dataExpireTimestamp: 1441830262<br />
entryUSN: 20521<br />
name: Doma_ls<br />
objectClass: sudoRule<br />
originalDN: cn=Doma_ls,ou=sudoers,dc=szilva<br />
sudoCommand: ls<br />
sudoHost: nappali.szilva<br />
sudoRunAsGroup: ALL<br />
sudoRunAsUser: ALL<br />
sudoUser: doma<br />
distinguishedName: name=Doma_ls,cn=sudorules,cn=custom,cn=szilva,cn=sysdb</div>
<div># returned 1 records<br />
# 1 entries<br />
# 0 referrals</div>
<div> </div>
<div>This confirms that the entry is indeed there in the db. Why is it found with ldbsearch and why does sssd_sudo not find it?</div>
<div> </div>
<div>I am pretty much stuck with this one. Anyone has an idea?</div>
<div> </div>
<div> </div>
</div>
</div>
</div>
</div>