Return
-
Title
Active Directory only groups requiring colon in sudoers file -
Description
A colon is required between the % and group name if using a non Unix enabled Active Directory group in the Sudoers file.
E.g.
%:mygroup ALL=(root) /bin/sh
The group members will not be matched without the colon. -
Cause
This is a 3rd party issue.
The following change has been made in the more recent versions of Sudo:"Added the always_query_group_plugin Defaults option to control whether groups not found in the system group database are passed to the group plugin. Previously, unknown system groups were always passed to the group plugin."
This issue has been recreated using Sudo 1.8.15.
-
Resolution
RESOLUTION 1:
Add the colon between the percentage symbol (%) and group name.
%:mygroup ALL=(root) /bin/sh
RESOLUTION 2
Add the following new option to the Sudoers file:Defaults always_query_group_plugin