Thank you for your explanation.

I looked in the sssd_<DOMAIN>.log and found the actual LDAP-Filter.
The problem seems to be the first part again: 
In the LDAP-Tree I can't see any attribute named entryUSN.

Is this related to the problem?

Best regards,

-----Ursprüngliche Nachricht-----
Von: Alexander Bokovoy [] 
Gesendet: Montag, 7. März 2016 09:07
An: Zoske, Fabian
Betreff: Re: [Freeipa-users] SSSD does not fetch Sudo Rules anymore

On Mon, 07 Mar 2016, Zoske, Fabian wrote:
>in our environment server (ipa-server-4.2.0-15.el7_2.6.x86_64 and
>sssd-1.13.0-40.el7_2.1.x86_64  on CentOS 7.2) and client
>(ipa-client-4.2.0-15.el7_2.6.x86_64 and sssd-1.13.0-40.el7_2.1.x86_64 
>on CentOS 7.2) SUDO rules doesn’t get fetched anymore.
>I debugged SSSD and SUDO and found out, that the first LDAP filter is
>(objectClass=sudoRule) and in our IPA-LDAP every rule has the class 
>“sudoRole” not “sudoRule”.
This has nothing to do with your problem. sudoRole is a known artefact from 
SUDO LDAP support -- the schema SUDO uses to store data in LDAP has this object 
class. SSSD searches in its own cache first and in that cache it uses an object 
class named sudoRule.

These are searches against different databases and they are perfectly fine.

>Is there a way to fix this behavior?
You need to find out what exactly is failing in your case, the 'difference' 
above is not a problem.


/ Alexander Bokovoy

Manage your subscription for the Freeipa-users mailing list:
Go to for more info on the project

Reply via email to