From 3f605ebfaa691043db7fc1798c4dea9848d3a50c Mon Sep 17 00:00:00 2001 From: "Todd C. Miller" Date: Tue, 30 Nov 2010 15:05:44 -0500 Subject: [PATCH] Clarify ordering of entries and attributes. --- doc/sudoers.ldap.pod | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/doc/sudoers.ldap.pod b/doc/sudoers.ldap.pod index a3059ab4e..ee0c5a147 100644 --- a/doc/sudoers.ldap.pod +++ b/doc/sudoers.ldap.pod @@ -153,11 +153,13 @@ If multiple B entries are present, the last one is used. =item B The sudoRole entries retrieved from the LDAP directory have no -inherent order. The B attribute is an integer that will -be used to sort the matching entries. This allows to more closely -mimic the behaviour of the sudoers file, where the of the entries -does have an influence on the result. If the B attribute -is not present, a value of 0 is assumed. +inherent order. The B attribute is an integer (or +floating point value for LDAP servers that support it) that is used +to sort the matching entries. This allows LDAP-based sudoers entries +to more closely mimic the behaviour of the sudoers file, where the +of the entries influences the result. If multiple entries match, +the entry with the lowest B attribute is chosen. If the +B attribute is not present, a value of 0 is assumed. =back @@ -195,8 +197,12 @@ to entries that satisfy the time constraints, if any are present. There are some subtle differences in the way sudoers is handled once in LDAP. Probably the biggest is that according to the RFC, LDAP ordering is arbitrary and you cannot expect that Attributes -and Entries are returned in any specific order. If there are -conflicting command rules on an entry, the negative takes precedence. +and Entries are returned in any specific order. + +The order in which different entries are applied can be controlled +using the B attribute, but there is no way to guarantee +the order of attributes within a specific entry. If there are +conflicting command rules in an entry, the negative takes precedence. This is called paranoid behavior (not necessarily the most specific match). -- 2.50.0