Hi, the sssd's code that fetches sudo rules from the IPA server got an overhaul recently. The search would no longer be performed against the compat tree, but against IPA's native LDAP tree. This would have the advantage that environments that don't use the slapi-nis' compat tree for another reason (like old or non-Linux clients) would no longer require slapi-nis to be running at all.
We'd like to get some tests for this new code! If you're running Fedora , you can just upgrade to the packages from Fedora's update testing. If you're running RHEL-6.7 and would like to see what is cooking for 6.8, you can try this repository: https://copr.fedorainfracloud.org/coprs/jhrozek/SSSD-6.8-preview/ RHEL-7 wouldn't receive this code until 7.3, so we don't have test packages for el7 yet.. -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project