After Sumit brought up a good point, I'm modifying this request.

Instead of modifying --users option functionality, I'd like to request a new --external (or similar) option. This will allow a distinction between adding IPA users and External ones coming from other sources like AD.

I'd think we'd keep the option similar to the group-add one used when adding AD groups/users to a group in IPA.

Changing 3.2 priority

Releasing tickets from distant milestones.

IPA already distinguishes between home IPA users and external users, no new option was added. The validation is still strict though:

# ipa sudorule-add-user test --users "external@ad.domain.test"
ipa: ERROR: invalid 'user': may only include letters, numbers, _, -, . and $

# ipa sudorule-add-user test --users "external"
  Rule name: test
  Enabled: TRUE
  Host category: all
  External User: foouser, external
  Sudo Allow Commands: /usr/bin/yum, /bin/mv
-------------------------
Number of members added 1
-------------------------

This looks as a basic use case for SUDO, lets move it to earlier release.

Related discussion with advise: http://www.redhat.com/archives/freeipa-devel/2015-May/msg00499.html

FreeIPA 4.2.1 was released, moving to 4.2.x.

Raven grooming:

• there is already ability to add an external user (in terms of not existing in IPA LDAP) but it is prevented by a validation rule for 'uid' param as described in https://www.redhat.com/archives/freeipa-devel/2015-May/msg00499.html
• the scope for this bug is to allow not checking the validation when 'uid' param is used within sudo commands.

PR: https://github.com/freeipa/freeipa/pull/4792

master:

• afcb060 Add design document for using AD users/groups in SUDO rules
• 172e4b9 baseldap: refactor validator support in add_external_pre_callback
• 5fae809 baseldap: when adding external objects, differentiate between them and failures
• 0ffdfc7 idviews: add extended validator for users from trusted domains
• a37db29 sudorule-add-user: allow to reference users and groups from trusted domains directly
• 349322e sudorule runAs: allow to add users and groups from trusted domains directly
• 09e06e0 ipatests: fix test_sudorule_plugin's wrong argument use
• 642b81e test_trust: add tests for using AD users and groups in SUDO rules
• c91a1a0 ipatests: when talking to AD DCs, use FQDN credentials
• 08d7209 baseldap: allow rejecting unknown objects instead of adding to an external attr

ipa-4-9:

• 16b30cb Add design document for using AD users/groups in SUDO rules
• 132d7fb baseldap: refactor validator support in add_external_pre_callback
• ffc2edf baseldap: when adding external objects, differentiate between them and failures
• a3563d1 idviews: add extended validator for users from trusted domains
• 054a068 sudorule-add-user: allow to reference users and groups from trusted domains directly
• 78043bf sudorule runAs: allow to add users and groups from trusted domains directly
• f4d3c91 ipatests: fix test_sudorule_plugin's wrong argument use
• a7c56fd test_trust: add tests for using AD users and groups in SUDO rules
• 64b70be ipatests: when talking to AD DCs, use FQDN credentials
• 51ca387 baseldap: allow rejecting unknown objects instead of adding to an external attr