Now I looked a little bit deeper into sudo source code. It gets user's registry using getuserattr() and then calls to setauthdb() to set the authentication database. To check a group, it calls later to getgrgid(), which should return group information.
The problem can be seen using the following C code:
#include <usersec.h>
#include <grp.h>
#include <stdio.h>
int main() {
int rc;
struct group *gr;
rc = setauthdb("LDAP", NULL);
if (rc != 0) {
printf("setauthdb RC = %d\n", rc);
return 1;
}
gr = getgrid(600); // hard-coded GID of the group we're searching for
if (gr == NULL) {
printf("Group ID 600 is not found\n");
return 1;
}
printf("Group name = %s, group id = %d\n", gr->gr_name, gr->gr_gid);
return 0;
}
If setauthdb("LDAP", NULL) is called, the local group can't be found, even if domainlessgroups = true.
If setauthdb("LDAP", NULL) is not called, both groups from LDAP and files are found.
I am not sure if it is AIX or sudo problem. AIX
getgrgid() doesn't say anything about setauthdb(). Quite the opposite:
Note: If the domainlessgroups attribute is set in the /etc/secvars.cfg file, the getgrnam or getgrgid subroutine gets group information from the Lightweight Directory Access Protocol (LDAP) and files domains, if the group name or group ID belongs to any one of these domains.
------------------------------
Andrey Klyachkin
https://www.power-devops.com------------------------------