Re: [Freeipa-users] Sudo denied on first attempt, allowed on second attempt

2014-03-04 Thread Jakub Hrozek
On Mon, Mar 03, 2014 at 02:01:52PM -0500, Steve Dainard wrote: Hi Jakub, id info from earlier response: Very interesting, my IPA group membership in ad_admins isn't shown by that command on first run (new login)

Re: [Freeipa-users] Sudo denied on first attempt, allowed on second attempt

2014-03-03 Thread Steve Dainard
Hi Jakub, id info from earlier response: Very interesting, my IPA group membership in ad_admins isn't shown by that command on first run (new login) sdainard-ad...@miovision.corp@__ubu1310:~$ id sdainard-admin

Re: [Freeipa-users] Sudo denied on first attempt, allowed on second attempt

2014-03-03 Thread Steve Dainard
Sumit, Unfortunately 1.11.1 is the only version available for Ubuntu 13.10. I've also had the same problem with an updated version of Fedora 20, so I don't think its specific to this package version. *Steve Dainard * IT Infrastructure Manager Miovision http://miovision.com/ | *Rethink Traffic*

Re: [Freeipa-users] Sudo denied on first attempt, allowed on second attempt

2014-02-24 Thread Pavel Brezina
Hi, I wasn't able to reproduce with membership setup exactly like this. I have already seen similar problem once, unfortunately the user stopped responding before we could reach the root cause. I think it is correct from the sudo point of view, what is problematic here is missing group

Re: [Freeipa-users] Sudo denied on first attempt, allowed on second attempt

2014-02-24 Thread Jakub Hrozek
On Mon, Feb 24, 2014 at 10:46:19AM -0500, Pavel Brezina wrote: Hi, I wasn't able to reproduce with membership setup exactly like this. I have already seen similar problem once, unfortunately the user stopped responding before we could reach the root cause. I think it is correct from the

Re: [Freeipa-users] Sudo denied on first attempt, allowed on second attempt

2014-02-24 Thread Sumit Bose
On Mon, Feb 24, 2014 at 10:46:19AM -0500, Pavel Brezina wrote: Hi, I wasn't able to reproduce with membership setup exactly like this. I have already seen similar problem once, unfortunately the user stopped responding before we could reach the root cause. I think it is correct from the

Re: [Freeipa-users] Sudo denied on first attempt, allowed on second attempt

2014-02-19 Thread Steve Dainard
Hi Pavel, sdainard-admin is a Windows domain user, part of an external group 'ad_admins_external' which is a member of 'ad_admins', an ipa posix group. 'admins' groups is the built-in ipa admin group. ipa group-show admins Group name: admins Description: Account administrators group GID:

Re: [Freeipa-users] Sudo denied on first attempt, allowed on second attempt

2014-02-17 Thread Pavel Březina
On 02/16/2014 01:19 AM, Steve Dainard wrote: Just experienced the same issue on Fedora 20: [sdainard-ad...@miovision.corp@fed20 ~]$ sudo systemctl stop firewalld [sudo] password for sdainard-ad...@miovision.corp: sdainard-ad...@miovision.corp is not allowed to run sudo on fed20. This incident

Re: [Freeipa-users] Sudo denied on first attempt, allowed on second attempt

2014-02-17 Thread Steve Dainard
I can't reproduce consistently on any OS including Fedora 20, but I was able to trigger the issue on a Ubuntu 13.10 client. sssd: 1.11.1 sudo: 1.8.6p3-0ubuntu3 I have only just enabled the sudo logging so it should only contain the events below: sdainard-ad...@miovision.corp@ubu1310:~$ sudo su