[XorNot]

Removing LDAP is a huge problem for the more important sudo deployments though: centralized management of permissions is kind of a vital function.

[JoshTriplett]

Debian is currently in the process of dropping the direct LDAP support in sudo, in favor of sssd. From sudo's NEWS.Debian.gz:

> In practice, there are few installations that use sudo-ldap. Most installations that use LDAP as a directory service and sudo have now opted for sssd, sssd-ldap and libsss-sudo.

> The Debian sudo team recommends the use of libsss-sudo for new installations and the migration of existing installations from sudo-ldap to libsss-sudo and sssd.

[XorNot]

Ah that makes more sense.

[rnijveld]

The features we specifically don’t support are those related to direct LDAP support within sudo, so things like loading a sudoers file directly from LDAP. Sudo-rs will use any user retrieved via NSS, such as when configured using SSSD to load LDAP users. And from the authentication side you can use whatever PAM supports, so anything like Kerberos etc, which again can be coupled with the same LDAP database.

[Filligree]

Those people can keep using sudo; it’s not going away. The rest of us get better security.

[immibis]

Having to type doas on systems without LDAP and sudo on systems with LDAP is abstraction leakage.

[fluidcruft]

Is it actually removing ldap or is it offloading to pam?

[dec0dedab0de]

Could you clarify what you mean by more important sudo deployments?