`ldap_sudo_search_base` is not set warning

[Orion Poplawski]

I'm starting to see this:

sssd_be[130128]: `ldap_sudo_search_base` is not set. SSSD will search 
the entire directory tree (dc=nwra,dc=com) for sudoRole objects. This 
may allow any LDAP principal with write access to any subtree to inject 
sudo rules granting arbitrary privileges. Set `ldap_sudo_search_base` to 
restrict the search scope (e.g., 'ou=sudoers,dc=example,dc=com').

Possibly due to an update to sssd-2.9.8-4.el9_8.1

But I already have:

sudo_provider = ipa

Shouldn't that already set an appropriate value for 
ldap_sudo_search_base?  I have an IPA domain and a trusted (by IPA) AD 
domain.  I'm not using ldap directly.

[Alexey Tikhonov]

On Wed, Jul 29, 2026 at 9:51 PM Orion Poplawski via sssd-users <
[e-mail]> wrote:
> I'm starting to see this:
>
> sssd_be[130128]: `ldap_sudo_search_base` is not set. SSSD will search
> the entire directory tree (dc=nwra,dc=com) for sudoRole objects. This
> may allow any LDAP principal with write access to any subtree to inject
> sudo rules granting arbitrary privileges. Set `ldap_sudo_search_base` to
> restrict the search scope (e.g., 'ou=sudoers,dc=example,dc=com').
>
> Possibly due to an update to sssd-2.9.8-4.el9_8.1
>
> But I already have:
>
> sudo_provider = ipa
>
> Shouldn't that already set an appropriate value for
> ldap_sudo_search_base?  I have an IPA domain and a trusted (by IPA) AD
> domain.  I'm not using ldap directly.

For the record: https://github.com/SSSD/sssd/issues/9030