>From 761e845dc0fac806e6c1587239a54d393452970c Mon Sep 17 00:00:00 2001
From: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
Date: Wed, 30 Sep 2015 18:34:44 +0300
Subject: [PATCH 2/2] man: Note filter_groups are not affecting nesting

Note that the "filter_groups" option doesn't affect nested member
inheritance, on the sssd.conf(5) manpage.
---
 src/man/sssd.conf.5.xml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index a49938b..fa1ea31 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -590,6 +590,14 @@ subdomain_inherit = ldap_purge_cache_timeout
                             to filter only users from the particular domain.
                         </para>
                         <para>
+                            NOTE: The filter_groups option doesn't affect
+                            inheritance of nested group members, since
+                            filtering happens after they are propagated for
+                            returning via NSS. E.g. a group having a member
+                            group filtered out will still have the member
+                            users of the latter listed.
+                        </para>
+                        <para>
                             Default: root
                         </para>
                     </listitem>
-- 
2.5.1