Question

A Linux administrator manages a fleet of servers joined to a central LDAP directory using SSSD. Users authenticate correctly, but members of the LDAP group 'dbadmins' report they cannot run privileged commands with sudo, even though a rule exists in /etc/sudoers referencing '%dbadmins'. Running 'id' as one of these users shows their LDAP username but does NOT list the 'dbadmins' group. What is the MOST likely cause?

Accepted Answer

SSSD is not resolving the user's LDAP group memberships, so the group does not appear in the user's ID and the sudoers rule never matches

Answer

The 'sudo' package is not installed on the affected servers

Answer

The sudoers rule must reference the group by GID number rather than by name for LDAP groups

Answer

Password authentication must be disabled in sshd_config before sudo group rules take effect