7f9ea23e74
In most unix-style LDAP servers, uid is a utf8 string defined by OID 1.3.6.1.4.1.1466.115.121.1.15. However, sudoUser was defined as an IA5 String (OID 1.3.6.1.4.1.1466.115.121.1.26) which meant that sudoUser could only represent a subset of possible values. In some cases when using sudoers.ldap, the uid from the machine which was utf8 was fed back into sudo which would then issue a search for sudoUsers. If this uid contained utf8 characters, the ldap server would refuse to match into sudoUsers because these were limited to IA5. This is a safe-forward upgrade as IA5 is a subset of UTF8 meaning that this change will not impact existing deployments and their rules.
80 lines
2.6 KiB
Plaintext
80 lines
2.6 KiB
Plaintext
dn: cn=sudoschema,cn=schema,cn=config
|
|
objectClass: olcSchemaConfig
|
|
cn: sudoschema
|
|
#
|
|
# OpenLDAP schema file for Sudo in on-line configuration (OLC) format.
|
|
# Import using ldapadd or another suitable LDAP browser.
|
|
# Converted to OLC format by Frederic Pasteleurs <frederic@askarel.be>
|
|
#
|
|
olcattributetypes: ( 1.3.6.1.4.1.15953.9.1.1
|
|
NAME 'sudoUser'
|
|
DESC 'User(s) who may run sudo'
|
|
EQUALITY caseExactMatch
|
|
SUBSTR caseExactSubstringsMatch
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
|
#
|
|
olcattributetypes: ( 1.3.6.1.4.1.15953.9.1.2
|
|
NAME 'sudoHost'
|
|
DESC 'Host(s) who may run sudo'
|
|
EQUALITY caseExactIA5Match
|
|
SUBSTR caseExactIA5SubstringsMatch
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
|
#
|
|
olcattributetypes: ( 1.3.6.1.4.1.15953.9.1.3
|
|
NAME 'sudoCommand'
|
|
DESC 'Command(s) to be executed by sudo'
|
|
EQUALITY caseExactIA5Match
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
|
#
|
|
olcattributetypes: ( 1.3.6.1.4.1.15953.9.1.4
|
|
NAME 'sudoRunAs'
|
|
DESC 'User(s) impersonated by sudo (deprecated)'
|
|
EQUALITY caseExactIA5Match
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
|
#
|
|
olcattributetypes: ( 1.3.6.1.4.1.15953.9.1.5
|
|
NAME 'sudoOption'
|
|
DESC 'Options(s) followed by sudo'
|
|
EQUALITY caseExactIA5Match
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
|
#
|
|
olcattributetypes: ( 1.3.6.1.4.1.15953.9.1.6
|
|
NAME 'sudoRunAsUser'
|
|
DESC 'User(s) impersonated by sudo'
|
|
EQUALITY caseExactMatch
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
|
#
|
|
olcattributetypes: ( 1.3.6.1.4.1.15953.9.1.7
|
|
NAME 'sudoRunAsGroup'
|
|
DESC 'Group(s) impersonated by sudo'
|
|
EQUALITY caseExactMatch
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
|
#
|
|
olcattributetypes: ( 1.3.6.1.4.1.15953.9.1.8
|
|
NAME 'sudoNotBefore'
|
|
DESC 'Start of time interval for which the entry is valid'
|
|
EQUALITY generalizedTimeMatch
|
|
ORDERING generalizedTimeOrderingMatch
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
|
|
#
|
|
olcattributetypes: ( 1.3.6.1.4.1.15953.9.1.9
|
|
NAME 'sudoNotAfter'
|
|
DESC 'End of time interval for which the entry is valid'
|
|
EQUALITY generalizedTimeMatch
|
|
ORDERING generalizedTimeOrderingMatch
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
|
|
#
|
|
olcattributeTypes: ( 1.3.6.1.4.1.15953.9.1.10
|
|
NAME 'sudoOrder'
|
|
DESC 'an integer to order the sudoRole entries'
|
|
EQUALITY integerMatch
|
|
ORDERING integerOrderingMatch
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
|
|
#
|
|
olcobjectclasses: ( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' SUP top STRUCTURAL
|
|
DESC 'Sudoer Entries'
|
|
MUST ( cn )
|
|
MAY ( sudoUser $ sudoHost $ sudoCommand $ sudoRunAs $ sudoRunAsUser $ sudoRunAsGroup $ sudoOption $ sudoOrder $ sudoNotBefore $ sudoNotAfter $
|
|
description )
|
|
)
|