<html> <head> <meta content="text/html; charset=windows-1252" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> Hello, Could you increase the debug level to 9, restart sssd + clear the cache and reproduce the problem then provide the sssd_<domain>.log as well as the sssd_sudo.log ? Also you may want to rule out HBAC issues with the below command: # ipa hbactest --user 'jgoddard' --host $(hostname) --service sudo Kind regards, Justin Stephenson <div class="moz-cite-prefix">On 08/11/2016 02:24 PM, Jeff Goddard wrote: </div> <blockquote cite="mid:CA+No-6FdeLQJPjknv4-GaQ=QoVk8043yT2w+pVNpAUn4W8yEZA@mail.gmail.com" type="cite"> <div dir="ltr"> <div>Here is relevant configuration files: nsswitch.conf: passwd: compat sss group: compat sss shadow: compat sss gshadow: files hosts: files dns networks: files protocols: db files services: db files sss ethers: db files rpc: db files netgroup: nis sss sudoers: sss files </div> sssd.conf: [domain/<a moz-do-not-send="true" href="http://internal.emerlyn.com">internal.emerlyn.com</a>] cache_credentials = True krb5_store_password_if_offline = True ipa_domain = <a moz-do-not-send="true" href="http://internal.emerlyn.com">internal.emerlyn.com</a> id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname = <a moz-do-not-send="true" href="http://docker-dev-01.internal.emerlyn.com">docker-dev-01.internal.emerlyn.com</a> chpass_provider = ipa ipa_server = _srv_, <a moz-do-not-send="true" href="http://id-management-1.internal.emerlyn.com">id-management-1.internal.emerlyn.com</a> ldap_tls_cacert = /etc/ipa/ca.crt sudo_provider=ipa ldap_uri=<a class="moz-txt-link-freetext" href="ldap://">ldap://</a><a moz-do-not-send="true" href="http://id-management-1.internal.emerlyn.com">id-management-1.internal.emerlyn.com</a> ldap_sudo_search_base=ou=sudoers,dc=internal,dc=emerlyn,dc=com debug_level=7 [sssd] services = nss, pam, sudo, ssh debug_level=7 domains = <a moz-do-not-send="true" href="http://internal.emerlyn.com">internal.emerlyn.com</a> [nss] homedir_substring = /home [pam] [sudo] debug_level=7 [autofs] [ssh] debug_level=7 [pac] [ifp] <div>Log output - /var/log/sssd/sssd_sudo.log: (Thu Aug 11 12:21:43 2016) [sssd[sudo]] [accept_fd_handler] (0x0400): Client connected! (Thu Aug 11 12:21:43 2016) [sssd[sudo]] [sss_cmd_get_version] (0x0200): Received client version [1]. (Thu Aug 11 12:21:43 2016) [sssd[sudo]] [sss_cmd_get_version] (0x0200): Offered version [1]. (Thu Aug 11 12:21:43 2016) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): name 'jgoddard' matched without domain, user is jgoddard (Thu Aug 11 12:21:43 2016) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): name 'jgoddard' matched without domain, user is jgoddard (Thu Aug 11 12:21:43 2016) [sssd[sudo]] [sudosrv_cmd_parse_query_done] (0x0200): Requesting default options for [jgoddard] from [<ALL>] (Thu Aug 11 12:21:43 2016) [sssd[sudo]] [sudosrv_get_user] (0x0200): Requesting info about [<a moz-do-not-send="true" href="mailto:jgoddard@internal.emerlyn.com">jgoddard@internal.emerlyn.com</a>] (Thu Aug 11 12:21:43 2016) [sssd[sudo]] [sudosrv_get_user] (0x0400): Returning info for user [<a moz-do-not-send="true" href="mailto:jgoddard@internal.emerlyn.com">jgoddard@internal.emerlyn.com</a>] (Thu Aug 11 12:21:43 2016) [sssd[sudo]] [sudosrv_get_rules] (0x0400): Retrieving default options for [jgoddard] from [<a moz-do-not-send="true" href="http://internal.emerlyn.com">internal.emerlyn.com</a>] (Thu Aug 11 12:21:43 2016) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(sudoUser=ALL)(name=defaults)(sudoUser=jgoddard)(sudoUser=#320000001)(sudoUser=%developers)(sudoUser=%jira-administrators)(sudoUser=%admins)(sudoUser=%ipausers)(sudoUser=%jgoddard)(sudoUser=+*))(&(dataExpireTimestamp<=1470932503)))] (Thu Aug 11 12:21:43 2016) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(name=defaults)))] (Thu Aug 11 12:21:43 2016) [sssd[sudo]] [sudosrv_get_sudorules_from_cache] (0x0400): Returning 0 rules for [<default options>@<a moz-do-not-send="true" href="http://internal.emerlyn.com">internal.emerlyn.com</a>] (Thu Aug 11 12:21:43 2016) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): name 'jgoddard' matched without domain, user is jgoddard (Thu Aug 11 12:21:43 2016) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): name 'jgoddard' matched without domain, user is jgoddard (Thu Aug 11 12:21:43 2016) [sssd[sudo]] [sudosrv_cmd_parse_query_done] (0x0200): Requesting rules for [jgoddard] from [<ALL>] (Thu Aug 11 12:21:43 2016) [sssd[sudo]] [sudosrv_get_user] (0x0200): Requesting info about [<a moz-do-not-send="true" href="mailto:jgoddard@internal.emerlyn.com">jgoddard@internal.emerlyn.com</a>] (Thu Aug 11 12:21:43 2016) [sssd[sudo]] [sudosrv_get_user] (0x0400): Returning info for user [<a moz-do-not-send="true" href="mailto:jgoddard@internal.emerlyn.com">jgoddard@internal.emerlyn.com</a>] (Thu Aug 11 12:21:43 2016) [sssd[sudo]] [sudosrv_get_rules] (0x0400): Retrieving rules for [jgoddard] from [<a moz-do-not-send="true" href="http://internal.emerlyn.com">internal.emerlyn.com</a>] (Thu Aug 11 12:21:43 2016) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(sudoUser=ALL)(name=defaults)(sudoUser=jgoddard)(sudoUser=#320000001)(sudoUser=%developers)(sudoUser=%jira-administrators)(sudoUser=%admins)(sudoUser=%ipausers)(sudoUser=%jgoddard)(sudoUser=+*))(&(dataExpireTimestamp<=1470932503)))] (Thu Aug 11 12:21:43 2016) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(sudoUser=ALL)(sudoUser=jgoddard)(sudoUser=#320000001)(sudoUser=%developers)(sudoUser=%jira-administrators)(sudoUser=%admins)(sudoUser=%ipausers)(sudoUser=%jgoddard)(sudoUser=+*)))] (Thu Aug 11 12:21:43 2016) [sssd[sudo]] [sort_sudo_rules] (0x0400): Sorting rules with higher-wins logic (Thu Aug 11 12:21:43 2016) [sssd[sudo]] [sudosrv_get_sudorules_from_cache] (0x0400): Returning 1 rules for [<a moz-do-not-send="true" href="mailto:jgoddard@internal.emerlyn.com">jgoddard@internal.emerlyn.com</a>] (Thu Aug 11 12:21:47 2016) [sssd[sudo]] [client_recv] (0x0200): Client disconnected! (Thu Aug 11 12:22:12 2016) [sssd[sudo]] [accept_fd_handler] (0x0400): Client connected! (Thu Aug 11 12:22:12 2016) [sssd[sudo]] [sss_cmd_get_version] (0x0200): Received client version [1]. (Thu Aug 11 12:22:12 2016) [sssd[sudo]] [sss_cmd_get_version] (0x0200): Offered version [1]. (Thu Aug 11 12:22:12 2016) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): name 'jgoddard' matched without domain, user is jgoddard (Thu Aug 11 12:22:12 2016) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): name 'jgoddard' matched without domain, user is jgoddard (Thu Aug 11 12:22:12 2016) [sssd[sudo]] [sudosrv_cmd_parse_query_done] (0x0200): Requesting default options for [jgoddard] from [<ALL>] (Thu Aug 11 12:22:12 2016) [sssd[sudo]] [sudosrv_get_user] (0x0200): Requesting info about [<a moz-do-not-send="true" href="mailto:jgoddard@internal.emerlyn.com">jgoddard@internal.emerlyn.com</a>] (Thu Aug 11 12:22:12 2016) [sssd[sudo]] [sudosrv_get_user] (0x0400): Returning info for user [<a moz-do-not-send="true" href="mailto:jgoddard@internal.emerlyn.com">jgoddard@internal.emerlyn.com</a>] (Thu Aug 11 12:22:12 2016) [sssd[sudo]] [sudosrv_get_rules] (0x0400): Retrieving default options for [jgoddard] from [<a moz-do-not-send="true" href="http://internal.emerlyn.com">internal.emerlyn.com</a>] (Thu Aug 11 12:22:12 2016) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(sudoUser=ALL)(name=defaults)(sudoUser=jgoddard)(sudoUser=#320000001)(sudoUser=%developers)(sudoUser=%jira-administrators)(sudoUser=%admins)(sudoUser=%ipausers)(sudoUser=%jgoddard)(sudoUser=+*))(&(dataExpireTimestamp<=1470932532)))] (Thu Aug 11 12:22:12 2016) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(name=defaults)))] (Thu Aug 11 12:22:12 2016) [sssd[sudo]] [sudosrv_get_sudorules_from_cache] (0x0400): Returning 0 rules for [<default options>@<a moz-do-not-send="true" href="http://internal.emerlyn.com">internal.emerlyn.com</a>] (Thu Aug 11 12:22:12 2016) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): name 'jgoddard' matched without domain, user is jgoddard (Thu Aug 11 12:22:12 2016) [sssd[sudo]] [sss_parse_name_for_domains] (0x0200): name 'jgoddard' matched without domain, user is jgoddard (Thu Aug 11 12:22:12 2016) [sssd[sudo]] [sudosrv_cmd_parse_query_done] (0x0200): Requesting rules for [jgoddard] from [<ALL>] (Thu Aug 11 12:22:12 2016) [sssd[sudo]] [sudosrv_get_user] (0x0200): Requesting info about [<a moz-do-not-send="true" href="mailto:jgoddard@internal.emerlyn.com">jgoddard@internal.emerlyn.com</a>] (Thu Aug 11 12:22:12 2016) [sssd[sudo]] [sudosrv_get_user] (0x0400): Returning info for user [<a moz-do-not-send="true" href="mailto:jgoddard@internal.emerlyn.com">jgoddard@internal.emerlyn.com</a>] (Thu Aug 11 12:22:12 2016) [sssd[sudo]] [sudosrv_get_rules] (0x0400): Retrieving rules for [jgoddard] from [<a moz-do-not-send="true" href="http://internal.emerlyn.com">internal.emerlyn.com</a>] (Thu Aug 11 12:22:12 2016) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(sudoUser=ALL)(name=defaults)(sudoUser=jgoddard)(sudoUser=#320000001)(sudoUser=%developers)(sudoUser=%jira-administrators)(sudoUser=%admins)(sudoUser=%ipausers)(sudoUser=%jgoddard)(sudoUser=+*))(&(dataExpireTimestamp<=1470932532)))] (Thu Aug 11 12:22:12 2016) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(sudoUser=ALL)(sudoUser=jgoddard)(sudoUser=#320000001)(sudoUser=%developers)(sudoUser=%jira-administrators)(sudoUser=%admins)(sudoUser=%ipausers)(sudoUser=%jgoddard)(sudoUser=+*)))] (Thu Aug 11 12:22:12 2016) [sssd[sudo]] [sort_sudo_rules] (0x0400): Sorting rules with higher-wins logic (Thu Aug 11 12:22:12 2016) [sssd[sudo]] [sudosrv_get_sudorules_from_cache] (0x0400): Returning 1 rules for [<a moz-do-not-send="true" href="mailto:jgoddard@internal.emerlyn.com">jgoddard@internal.emerlyn.com</a>] </div> </div> <div class="gmail_extra"> <div class="gmail_quote">On Thu, Aug 11, 2016 at 2:15 PM, Rob Crittenden <<a moz-do-not-send="true" href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Jeff Goddard wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> I've looked though these but not found anything helpful. It appears as though my previous statement about the 1 group being found was misleading as the sssd.$mydomain.com.log file reports that no sudo rules are found. Does this mean that the LDAP tree being searched is different on ubuntu vs centos? </blockquote> I find that extremely unlikely. You may want to outline more what you've already checked. For example, is sss in sudoers in /etc/nsswitch.conf? You can check the 389-ds access log to see what, if any queries are being made. I'd clean the sssd cache in advance. rob <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Jeff On Wed, Aug 10, 2016 at 2:13 PM, Rob Crittenden <<a moz-do-not-send="true" href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a> <mailto:<a moz-do-not-send="true" href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>>> wrote: Jeff Goddard wrote: Sean, Thanks for the reply. I don't think that's my problem but I'm posting a redacted copy of the sssd.conf file for review below. I'd start here: <a moz-do-not-send="true" href="https://fedorahosted.org/sssd/wiki/HOWTO_Troubleshoot_SUDO" rel="noreferrer" target="_blank">https://fedorahosted.org/sssd/wiki/HOWTO_Troubleshoot_SUDO</a> <<a moz-do-not-send="true" href="https://fedorahosted.org/sssd/wiki/HOWTO_Troubleshoot_SUDO" rel="noreferrer" target="_blank">https://fedorahosted.org/sssd/wiki/HOWTO_Troubleshoot_SUDO</a>> rob </blockquote> </blockquote> </div> -- <div class="gmail_signature" data-smartmail="gmail_signature"> <div dir="ltr"> <div> <div> <div>Jeff Goddard </div> Director of Information Technology </div> Emerlyn Technology Email: <a moz-do-not-send="true" href="mailto:jgoddard@emerlyn.com" target="_blank">jgoddard@emerlyn.com</a> Telephone: (603) 447-8571 Toll free: (888) 363-7596 ext. 108 Fax: (603) 356-3346 </div> </div> </div> </div> <fieldset class="mimeAttachmentHeader"></fieldset> </blockquote> </body> </html>