[sudo-users] objectClass=sudoRule vs objectClass=sudoRole in AD

[Todd C. Miller]

On Fri, 11 Oct 2013 12:43:40 -0400, Curtis.CTR.Roze at faa.gov wrote:

> I pulled the debug query from the sssd_sudo.log. How would the 
> ldap debug be different?

If you are using the sudo sssd backend then ignore what I said about
sudoers_debug in ldap.conf.  The sssd bits use a different LDAP
schema.

What you are seeing sounds a lot like:
    https://fedorahosted.org/sssd/ticket/1912

 - todd