Ticket #1505 (closed defect: worksforme)

Opened 4 years ago

Last modified 4 years ago

sudo with sss backend should use ipa_hostname

Reported by: dpal Owned by: somebody
Priority: major Milestone: SSSD 1.9.0 RC1
Component: SSSD Version:
Keywords: Cc:
Blocked By: Blocking:
Sensitive: Tests Updated: no
Coverity Bug: Patch Submitted: no
Red Hat Bugzilla: 853540 Design link:
Feature Milestone:
Design review: Fedora test page:
Chosen: Candidate to push out:
Release Notes:
Temp mark:


https://bugzilla.redhat.com/show_bug.cgi?id=853540 (Fedora)

Description of problem:

The "ipa_hostname" option in sssd.conf can be used to override the
machine's hostname, which is useful when 3rd-party applications like
SAP require a short hostname instead of the FQDN.

When sudo is used with the sss backend, it checks the sudo rules from
the IPA server against the machine's hostname, not against the value
of the ipa_hostname parameter.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:

1. Add "sudoers: files sss" in /etc/nsswitch.conf

2. Add the following lines in /etc/sssd/sssd.conf:

   ipa_hostname = client01.example.com
   sudo_provider = ldap
   ldap_uri = ldap://idm01.example.com
   ldap_sudo_search_base = ou=SUDOers,dc=example,dc=com
   ldap_sasl_mech = GSSAPI
   ldap_sasl_authid = host/client01.example.com
   ldap_sasl_realm = EXAMPLE.COM
   krb5_server = idm01.example.com

   services = nss, pam, ssh, sudo


3. Run

   su - testuser
   sudo -l

Actual results:

If the sudo rule in IPA is restricted to client01.example.com,
"sudo -l" works as long as the hostname is left at its original value.

After running "hostname client01" and clearing the sssd cache,
"sudo -l" doesn't show the sudo rules anymore.

Expected results:

sudo should honor the ipa_hostname value when the sss backend is used.

Change History

comment:1 Changed 4 years ago by jhrozek

  • Status changed from new to closed
  • Tests Updated unset
  • tests set to 0
  • upgrade set to 0
  • Resolution set to worksforme

As discussed in the associated bugzilla entry, this has been already implemented as part of the sudo redesign.

comment:2 Changed 4 years ago by dpal

  • Milestone changed from NEEDS_TRIAGE to SSSD 1.9.0 RC1
Note: See TracTickets for help on using tickets.