# uhhm corp: machine admin rights come from the kanidm `admins` group, so a
# fresh machine has a working administrator the moment the distro's default
# user is removed.
#
# The group MUST be POSIX-enabled or it never reaches NSS and this rule matches
# nobody (an unmatched group here is harmless):
#     kanidm group create admins
#     kanidm group add-members admins <user>
#     kanidm group posix set admins
#     kanidm-unix cache-invalidate        # on each machine
#
# sudo resolves the group through NSS at command time, so if kanidm-unixd is
# down this rule cannot be evaluated. Keep a break-glass path: root's password,
# or a local admin account whose name does not exist in kanidm.
# NOPASSWD: kanidm POSIX passwords are long, corp machines lock their screens,
# and the alternative in practice is people picking shorter passwords. The
# trade-off: anything running as an admin user can escalate without a prompt.
%admins ALL=(ALL:ALL) NOPASSWD: ALL
