On 02/09/2016 08:09 AM, Jakub Hrozek wrote:

On Mon, Feb 08, 2016 at 01:56:07PM +0100, Pavel Reichl wrote:

diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index 73a21bfa0049bc4d3cfacb49201707868c87e533..2dbc58a451686beda0faa9e9366bbc3b3b4c253e 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -1040,6 +1040,27 @@ pam_account_expired_message = Account expired, please call help desk.
                      </listitem>
                  </varlistentry>
                  <varlistentry>
+                    <term>pam_account_locked_message (string)</term>
+                    <listitem>
+                        <para>
+                           If user is authenticating and

Please ask someone for an English review (I know Dan started, but I
didn't see a fixed version yet). At the very least, this should read "a
user".

I attached Dan's patch. I took the liberty of adding note regarding pam verbosity. Hope it's fine by Dan.

+                           account is locked then by default
+                           'Permission denied' is output. This output will
+                           be changed to content of this variable if it is
+                           set.
+                        </para>
+                        <para>
+                            example:
+                            <programlisting>
+pam_account_locked_message = Account locked, please call help desk.
+                            </programlisting>
+                        </para>
+                        <para>
+                            Default: none
+                        </para>
+                    </listitem>
+                </varlistentry>
+                <varlistentry>
                      <term>p11_child_timeout (integer)</term>
                      <listitem>
                          <para>

The rest of the patch looks good to me and seems to work as advertized.

Thanks.