>From 36852bb9e89087ccb5333690838685a51aa2ada0 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Wed, 5 Mar 2014 12:13:48 +0100 Subject: [PATCH 2/3] MAN: Clarify the GC support a bit It should be noted that disabling GC does *not* disable lookups from trusted domains. Disabling GC might be a a good way for admins who wish to use POSIX attributes in trusted domains and the man page should hint this option. --- src/man/sssd-ad.5.xml | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/src/man/sssd-ad.5.xml b/src/man/sssd-ad.5.xml index 9b39e081c07d5cdee8b7aa8bb464901e6951d499..1e38c13a95fcbcc242f3e9e8c9eda6e23e7a67c7 100644 --- a/src/man/sssd-ad.5.xml +++ b/src/man/sssd-ad.5.xml @@ -232,11 +232,19 @@ FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com) By default, the SSSD connects to the Global - Catalog first to retrieve users and uses the - LDAP port to retrieve group memberships or - as a fallback. Disabling this option makes - the SSSD only connect to the LDAP port of the - current AD server. + Catalog first to retrieve users from trusted + domains and uses the LDAP port to retrieve + group memberships or as a fallback. Disabling + this option makes the SSSD only connect to + the LDAP port of the current AD server. + + + Please note that disabling Global Catalog support + does not disable retrieving users from trusted + domains. The SSSD would connect to the LDAP port + of trusted domains instead. However, Global + Catalog must be used in order to resolve + cross-domain group memberships. Default: true -- 1.8.5.3