Thanks again, Lukas! I was wondering if the overlaps of names was a problem, so I redid parts of my IPA setup to rename them - thanks for pointing out the ticket!
Also, your suggestion to use ldap_group_object_class = ipaUserGroup worked - which saves me the trouble of tracking that down in six months when my IPA domain grows and the performance issues associated with enumerate begin to manifest. Many thanks - you are extraordinarily helpful. My colleagues and I are quite grateful for all your advice! Thanks again, Andrew On Mon, Apr 20, 2015 at 1:29 AM, Lukas Slebodnik <lsleb...@redhat.com> wrote: > On (19/04/15 12:51), Andrew Sacamano wrote: > >Thanks again Lukas, > > > >These turned out to be very helpful debugging suggestions, and were the > >critical part of getting the problem solved - the pointer to ldb-tools was > >extremely helpful in identifying where the issue was happening! > > > >With them, I was able to see the right sudo rules were being cached, and > >that the change from sudo working to sudo not working happened not because > >of the host, but because of the user, and in particular, the user being a > >listed explicitly, or only as part of a group. The user's groups were > >being listed in the user's entry in the cache, but not when running the > >"id" command. Some quick googling, and I discovered that in Ubuntu 14.04, > >the sssd option "enumerate" defaults to false, which meant that the group > >memberships were not taking effect, which meant that sudo rules based on > >membership in a group weren't working. Setting enumerate to true got > >everything working. > > > If you have a problem with "id" might be caused by > https://fedorahosted.org/sssd/ticket/2471 > > You can fix the bug with ammending configuration. > put ldap_group_object_class = ipaUserGroup > into domain section of sssd.conf > > It should work even with disabled enumeration. > > LS >
-- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project