How is a sudo rule stored in Active Directory, for example to let web developers restart the web server?

Extend the AD schema with the sudo project's sudoRole class, then create one sudoRole object per rule with the attributes sudoUser, sudoHost and sudoCommand.

1. Extend the schema. AD does not know sudo rules by default. The sudo project ships a schema file, which is imported with ldifde. Changing the schema needs membership in Schema Admins, a highly privileged group that should otherwise stay empty.
2. Create a container sudoers (an object of class sudoRole) in ADSI Edit. The normal "Users and Computers" tool cannot edit these attributes.
3. Create one sudoRole per rule. Each object is one line of a sudoers file:

The ticket asked for "sudo rights", but the rule follows the principle of least privilege: the web developers can restart Apache on one host and nothing else. A rule like sudoCommand: ALL would have made them full root.

Go deeper:

• sudo.ws: sudoers.ldap manual — every sudoRole attribute and how rules are matched.