>From 28f17c871ad1119b40f352c5c8551cd8da3cb696 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek@redhat.com>
Date: Sun, 9 Jun 2013 12:14:07 +0200
Subject: [PATCH] man: document the need to set ldap_access_order

https://fedorahosted.org/sssd/ticket/1789

ldap_access_order must be set in order to non-default access control
options to work. This patch amends the sssd-ldap man page to document
this fact with all non-default ldap_access_order options.
---
 src/man/sssd-ldap.5.xml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index 37df5ec1b2e0b150b407f5e3e39db21860055580..97b5fdc578a709b5f8d0bfd294cad78cd8a2dc33 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -717,6 +717,13 @@
                             for allow_all (*).
                         </para>
                         <para>
+                            Please note that the ldap_access_order
+                            configuration option <emphasis>must</emphasis> include
+                            <quote>authorized_service</quote> in order for the
+                            ldap_user_authorized_service option
+                            to work.
+                        </para>
+                        <para>
                             Default: authorizedService
                         </para>
                     </listitem>
@@ -737,6 +744,13 @@
                             for allow_all (*).
                         </para>
                         <para>
+                            Please note that the ldap_access_order
+                            configuration option <emphasis>must</emphasis>
+                            include <quote>host</quote> in order for the
+                            ldap_user_authorized_host option
+                            to work.
+                        </para>
+                        <para>
                             Default: host
                         </para>
                     </listitem>
@@ -1759,6 +1773,13 @@ ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com
                             <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/experimental.xml" />
                         </para>
                         <para>
+                            Please note that the ldap_access_order
+                            configuration option <emphasis>must</emphasis>
+                            include <quote>expire</quote> in order for the
+                            ldap_account_expire_policy option
+                            to work.
+                        </para>
+                        <para>
                             Default: Empty
                         </para>
                     </listitem>
-- 
1.8.2.1