SUDO and SU issue when authenticated by Active Directory

Greetings...I have searching the net pretty extensivelly but have to admit that I am too frustrated to search here for the answer, I'm just posting...so please forgive me and I hope to be able to forgive myself becuase of how much I HATE seeing the same question asked 294892948503958392028590 times cause people don't spend .023848302 milliseconds on a simple search.

Anyway, I have really struggled with Active Directory integration....mainly because NOWHERE, ANYWHERE, in any of the Apple doc's did they touch on the VERY VERY VERY IMPORTANT nugget of wisdom that states:

YOU CAN NOT...I REPEAT, YOU CAN NOT HAVE A PRE-EXISTING LOCAL USERNAME THAT IS THE SAME AS AN ACTIVE DIRECTORY USERNAME

And considering that I only have one name I fell face first into this gem of a tar pit. Well i got that cleared up but I have to admit that it was no walk in the park....felt more like friggin brain surgery.

So, here I am finally logged into my Mac via Active Directory, got my home drive mounting and caching, just about to unleash this on our organization when I luckely decided to load nmap from MacPorts only to find out that sudo and su do not work. Now get this...

[david@Mackie on Sun Dec 17 at 09:42 AM ~]$su -l
Password:
su: Sorry
[david@Mackie on Sun Dec 17 at 09:42 AM ~]$tail -3 /var/log/secure.log
Dec 17 10:03:16 Mackie com.apple.SecurityServer: authinternal authenticated user root (uid 0).

HOW KOOKIE IS THAT!!!!!!!

So in order to gain root, I have to su to a local user, then su to root.

Anyone?

MacBook Pro 15, MacBook Pro 15 Mac OS X (10.4.8)

Posted on Dec 17, 2006 8:07 AM

Dec 28, 2006 11:23 AM in response to Steve Herman1

one thing to remember about OS X is that it's a cobbling together of new and old tech, sudo being "old". It only looks at what is specifically within the local admin group, and it can't understand the numeric IDs of the AD objects.

So while you may have admin functions if your account is part of an admin group added via Directory Access, you won't have sudo access.

If you have an account that really needs sudo access, add it in manually by name to either the suduers or the admin group

Pieace of extra info: Apple is actually using an OLD version of sudo. The sudo in 10.4.8 is version 1.638p5 from November 26th, 2004. The current release is 1.6.3p12 released on November 8, 2005.