[sudo-users] Active Directory Schema incomplete? (and SUDOERS_TIMED attributes not working)

[Todd C. Miller]

Thanks, I've made those fixes to the schema.ActiveDirectory file
in the sudo source repo.

I see that AD includes tenths of a second in its timetstamps.  Sudo
does not include fractional seconds when it constructs the time
filter, as it is optional, but perhaps this is causing problems.
You can try editing plugins/sudoers/ldap.c and changing the
"%Y%m%d%H%M%SZ" to "%Y%m%d%H%M%S.0Z" to see if that makes any
difference.  I recall that the Tivoli Directory Server required
that the seconds field be present, perhaps AD has a similar requirement
for tenths of a second.

 - todd