Hello,
I use RHEL 8.9 update today.
I joined my Active Directory domain animals.internal with realm join.
I permitted users of group koalas@animals.internal to log on through SSH.

Then the user pete (member of koalas) is able to log on on RHEL server.

I created a file called /etc/sudoers.d/animals.internal with the following text:

%koalas@animals.internal ALL=(ALL) NOPASSWD:ALL

But when pete runs "sudo su -", he gets
pete@animals.internal is not in the sudoers file. This incident will be reported.

I checked the syntax and it's ok.

visudo -c /etc/sudoers.d/animals.internal
/etc/sudoers.d/animals.internal: parsed OK

If I move the line %koalas@animals.internal ALL=(ALL) NOPASSWD:ALl on /etc/sudoers file, it works.

/etc/sudoers last line is
#includerdir /etc/sudoers.d/

The command ls -la /etc/sudoers.d/animals.internal
returns -r--r-----
Selinux is disabled.

What did I do wrong?

Sudo version is 1.9.5p2

You need to uncomment this line:otherwise it wont be run.

Reading the man of sudoers, lines is that start with # are comments unless the # is immediately followed by either include or includedir.

in that case I think the permissions on that file is not accepted by sudo. Or something similar happened.
by the way sudo and su should not be used together (but it is another issue).

That should be "#includedir", not "#includerdir".

The misspelling makes that line a comment, and thus no syntax error found.

Isn't there some issue with ssh access on this?? I forget.

That seems like a "lazy hack" on the part of the original programmer in question. Why not use another preceding character, like '$'? Oh well, water under the bridge now.

You say "lazy hack." I say it's just dumb. I wonder what possessed that developer? <sigh>

One site said they used new @

I suspect that it's just because "#include" is common in many other languages, and the programmer just got too used to typing it.

yes, it is an extremely "inconvenient" construct, but perfect if you just want to get a rise out of the user

In the file I keep the original line
#includedir /etc/sudoers.d/
I wrote here as "#includerdir /etc/sudoers.d/" but it's "#includedir /etc/sudoers.d/" indeed.

Maybe I'll do some syscall tracking to address this strange behavior.