Managing sudo using Active Directory: is it possible to use NOPASSWD: or other tags?

[ajkelsey]

So I have configured Active Directory to manage sudo permissions on Linux hosts. The domain users can successfully logon and use sudo. However, in order to move away from password use and only use ssh-keys, I'll need to use the NOPASSWD: tag. I'm not seeing an attribute in the AD schema where I can specify tags. Is there a way to do that?

[millert]

There are no tags in the LDAP-based sudoers, you use a sudoOption instead. E.g.

sudoOption: !authenticate

It would probably be helpful to call this out specifically in the sudoers.ldap manual. You can also use the cvtsudoers utility to convert a sudoers file entry to LDAP format to see how tags translate to sudoOptions.

[ajkelsey]

That worked, Todd. Thanks for the information!